> For the complete documentation index, see [llms.txt](https://wiki.astrawireless.net/astra-wireless-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.astrawireless.net/astra-wireless-documentation/technical-documentation/astrawireless-evolution-technical-user-manual/troubleshooting/unicast-flood-detection.md).

# Unicast-flood detection⁣⁣⁣⁣

**Unicast-flood** occurs when the unicast frame's destination MAC-address is unknown for the switch (not included in its routing table), it sends this frame to all interfaces of the network, besides the sender interface. The most common reasons of unicast-flood are:

* MAC address table overflow (a common problem in large networks)
* Hosts with ARP timers longer than the ARP cache time on switches
* Incorrect STP settings
* Incorrect switch groups settings (in particular, when the IDs of switch groups for the receiving and sending traffic are different).

The unicast flooding process on devices works as follows. If the destination MAC address of a frame is not in the switch forwarding table of the device, the frame is sent to all interfaces except the sender's. When a device first receives a frame, it adds an entry with the destination MAC address to the table. However, packets continue to be sent to all interfaces for four seconds. During this time, if the device receives a response frame with this MAC address as the source, the MAC address is added to the switch's forwarding table and assigned to the interface from which the response was received. If the device does not receive a response within four seconds, the table entry is locked for one second. Then, the entry is removed from the table and the process begins again.

| Time since record creation | Switch action                                                                                                                                 |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| 0 - 4 sec                  | Record created. Frames are sent to all interfaces except the sender interface. Frames increment the "flood" counter in the switch statistics. |
| 4 - 5 sec                  | Frames are discarded. Frames increment the "Unreachable" counter in the switch statistics.                                                    |
| ≥ 5 sec                    | Record deleted. The cycle starts over.                                                                                                        |

This process has the following representation in the unit's interfaces and links graphs:

<figure><img src="/files/miIKQ2kzc0ZNBidyPS3W" alt=""><figcaption></figcaption></figure>

Also, unicast-flooding can be detected in the "Switch Statistics" → "Device Status" tab in "Flood" column:

<figure><img src="/files/w60RisTrT49QuBM9dNkX" alt=""><figcaption></figcaption></figure>

To remove restrictions on unicast flooding through a switching group, check the "Flood" box in the "Basic Settings" → "MAC Switch" section. This will prevent entries from being created in the flood table, and the destination MAC address will not be blocked every four seconds.

<figure><img src="/files/LDwpAx4YBNoFYYnbBtz3" alt=""><figcaption></figcaption></figure>