MAC Aging Time Calculator

Until you have a network problem, you probably don’t think about MAC addresses. You’re taking that video call and your Wi-Fi signal momentarily goes down. Or maybe you’re moving a virtual machine and it just locks up. The LEDs on your switches look fine; but there’s some stale entry in the forwarding database that blocks traffic. That’s the kind of friction Layer 2 switching has.

It relies on MAC aging time. That’s the timer that says: How long does the switch remember which port a given device was connected to? If it is set wrong, you’ll see either traffic being blackholed or unneccesary broadcast flooding.

How to Set the Right MAC Aging Timer

Basically you don’t want to blindly believe what the calculator tells you; unless you understand what it’s calculating.” It does calculation. You just need to understand what each value means. That all hinges on a fundamental trade-off: how accurate do you want your forwarding? How much should you compromise on memory efficiency?

Switches only have so much space in their CAM tables. If there are too many entries, they’ll fill up with old information about devices that aren’t there anymore. This cause them to drop new ones. Make the timer too small and quiet device will time out before you’re ready. When a new one comes along, switch will flood the traffic to everyone because it doesn’t know where it goes anymore. That generates noise and can cause a broadcast storm.

By default most home labs use a three hundred second timer, or five minutes. That’s fine if you have only static wired devices like printers and desktops. Throw in mobility and it doesn’t work anymore. When I connect to a Wi-Fi network, I move from one AP to another and am on a new port. The switch continues to send packets along the old port where the client used to be until that entry ages out. For several seconds, the switch think my client is still there, sending packets down an incorrect cable and dropping voice packets.

A one-hundred twenty second timer reduce instability for quiet devices. While raw timer time is important, it’s not everything. What are the devices on that VLAN? Are they security cameras? Or are they virtual machines? Cameras will constantly be sending video streams, so their MAC entry gets refreshed every couple of seconds. No need for a long timer. If you have a virtual machine, it can instantly migrate across ports. It needs the switch to pick up on this change promptly. The calculator takes into account cases like this (hypervisor bridges and wired access VLANs). Depending off your setup, different timers is best.

The other thing you should look at is the ARP gap. That’s another one that bites admins in the butt. Most home labs default to keeping track of where a device is located for about 5 minutes. After this time, it just forgets where the device was connected. The router also keeps track of IP-to-MAC mappings in a cache (typically for 20 minutes). Let’s say your laptop goes to sleep. Now the switch doesn’t know where the laptop is. When it wakes up, the router sends a packet out on the previous port. Since there is no mapping in the switch for that port, the switch broadcast it to all ports. This creates a flood of unknown unicast packets, causing a spike in unknown unicast traffic. These floods saturates the switch CPU if hundreds of sleeping computers does it. Increasing the MAC aging timer help here because it keeps those entries alive longer and prevents the floods from occurring.

There is no one right answer. Any right answer is fine. It is just the right answer for you given your level of risk. Fast roam will accept some flooding as a price. Slow failover will accept some quiet as a trade-off. The tool takes the balance between those three: how sensitive it is to flooding, how often it needs to move, and how many entries exist. Takes away guessing.

Know your network condition. Is there a lot of movement? Are things asleep? Is this a lab where stuff gets broken all the time? Those answers will tell you what the timer should of been.

Remember: there’s no single number that defines how you tune a switch; it’s more of an exercise in watching what switches do than remembering what the vendors’ defaults are. Keep an eye on MAC move logs. Watch the unknown unicast counters. Understand that when things flap, it usually doesn’t indicate a timer problem but instead some type of topology problem (e.g., bad cable, loop). No amount of timer tweaking can fix a loop or a bad cable. The timer is then a way to smooth out the network experience after the cabling is solid. Then it helps the network to work quietely and invisibly.