Arista switch - Ghost traffic

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

salvadorb

Member
Jul 14, 2021
44
2
8
Hi guys,
I hope you are doing great. I am facing a really strange case of ghost traffic. The setup is an Arista DCS-7060CX-32S (I also tried an Arista DCS-7050QX-32S and saw the same behavior) that is replicating the traffic of one port to all others, acting like a HUB instead of a switch. I have confirmed that there's no port mirroring setting configured on the switch.

The "source" port is connected to a Mikrotik switch CRS, and then connected to a CCR1072. The Arista port it's sending around 15Gbps of traffic to the Mikrotik. The strange thing is that all this traffic is replicated in all the other ports in the Arista switch (plus the valid traffic to these ports).

Any idea what could be causing this?
 

altmind

Active Member
Sep 23, 2018
285
101
43
i dont know if Arista DCS-7060CX-32S got a hub mode, but if it is, thats exactly how hubs are supposed to work? hubs dont learn the mac table and flood the traffic on all ports - the client is to filter out his dest traffic.

plz draw the net diagram, your network setup is unclear.
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,729
3,083
113
33
fohdeesha.com
I would start by looking through the MAC table, if it's full, it will start acting like a hub and flooding to all linked ports because it can no longer keep track of mac <> port mapping, or if for some reason it's failing to learn the MAC addrs of things it will do the same. run "show mac address-table" and see if everything looks like it should, or if maybe for some reason your mikrotik is claiming all your other hosts mac addrs, so they're showing up as being on the mikrotik port on the arista. you can also get a brief count of total entries with "show mac address-table count"