I have a few Juniper EX3300 switches in my core. I'm seeing something strange where packets destined for device with the MAC address 00:90:0b:30:2d:f2 are being flooded out all interfaces. However, an entry for this MAC address exists in the ethernet-switching table.

Any ideas what could be causing this? According to the ethernet-switching table, the switch should know to forward these frames out ge-0/0/33 just fine.

VLAN: default, Tag: 1, MAC: 00:90:0b:30:2d:f2, Interface: ge-0/0/33.0
Type: Learn, Age: 0, Learned: 3w6d 22:04:44
Action: Forward
Nexthop index: 1326

This began yesterday afternoon, and we have not recently made any changes to the network. I found this when checking out PRTG. I noticed that a bunch of devices which should not be passing any traffic were suddenly being flooded with ~100 Mbps of traffic.

  • It doesn't have anything to do with the MAC address, what type of device is it; a switch or AP possibly? Do a packet capture and see what type of traffic it's flooding out. How do you know this is unicast? There's really a few options, you have a broadcast/multicast storm or a loop (either layer 2 or layer 3) somewhere in the network tying into that device. You could configure storm control but that's not really getting to the root of the issue in order to resolve it. If you provide answers to the questions above I can help you out more, otherwise hopefully this is enough to troubleshoot and r – Fallacy11 Oct 30 '15 at 5:50
  • This is definitely related with the MAC address. The device is stated at the top of the question, a juniper ex3300 switch. The problem is that the switch should only be flooding a unitary packet out all interfaces if the destination MAC is unknown. But in this case, the MAC exists in the Ethernet-switching table on the correct interface. We should not see this packet being flooded out to all devices connected to this switch. I was able to resolve this by clearing the Ethernet-switching table and letting it re-learn. But I'm still unsure why this would happen in the first place. – Ethan H. Oct 30 '15 at 12:26
  • Feel free to post your own answer as it looks like your issue has ceased before getting to the root cause. I wish we could have helped more as I know how unsettling it is to fix something without doing anything to repair it. – Ryan Foley Dec 29 '15 at 23:00
  • Hi Ryan, this remains "unresolved". Ticket opened with Juniper, however they have yet to provide any useful help, other than to tell me to manually flush the ethernet-switching table each time this happens… This is a bug in JunOS. – Ethan H. Jan 3 '16 at 19:25
  • @EthanH. Could you do a packet capture of one of the interfaces being flooded and the interface of the device whose MAC address is being used as the destination. This can be captured by user the "monitor traffic interface <interface> write-file <name.pcap> size 1514". Also are all devices on the same VLAN? if not please post your configuration. – Brian Winning Jr. Aug 16 '16 at 1:18