I am scratching my head to understand the condition of why a 5K appears to be flooding traffic across a vlan for MAC addresses it should have learned and be in its active forwarding table.
I have a 7K routing layer (2) cross connected to a 5K switching layer (2). I have around 5K mac addresses total across 60 vlans which are routed within the 7Ks. I have a host with wireshark running on a machine attached to vlan 251 as an access port. Nothing mirrored, just capturing traffic on its lan port. I should only be getting traffic for itself and anything on the vlan broadcast, multicast or flooded. My concern is the floodiing, see attached view of wireshark output. My mac aging timers are for 4 hours, but I have tried different settings from default and this behavior continues. I have monitored for this particular host mac and at a minimum it broadcasts each 20 minutes for its default gateway. In packet 37906 we see a src mac received by my machine of 16e0, that has been broadcast. At that point at a minimum the switch should know the port that mac comes in and no longer need to flood. At packet 38234 (22 seconds later), we see traffic that must have been flooded for it to be sent to an unrelated port to that mac 16e0. I see this a few times per day for short periods and I cannot reason out a cause. I am running - n5000-uk9.7.3.5.N1.1.bin and have 12 Fexs dual homed to the 5K where hosts are attached. Any thoughts or ideas would be appreciated.
