Why Nexus 5K show 2 mac addresses in 1 interface?

[SubnetWarrior]

Hi experts,

So my company has nexus 5K as its data center switch. 

We have a problem that there is a virus with ip address X.X.X.31. We have arp and mac address table that ip address and found that ip address is int the eth1/20 of our nexus 5K. 

But we found that there is 2 mac address in that interface : 

And we also find that the other mac address is belong to UCS Server with ip : X.X.X.21.

Would you please explain and how to fix it?

[luis_cordova]

Hi @SubnetWarrior ,

Check this discussion:

https://community.cisco.com/t5/switching/show-mac-address-table-question/td-p/1991838

And this link:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/MACAddress.html

Regards