MAC address moves are a routine part of an Ethernet VPN (EVPN) fabric. When a virtual machine migrates to a new host, it keeps its MAC address; the new leaf switch learns it and advertises the change through BGP so traffic can follow. But the same process can be abused if another device claims a MAC address it does not own.
The risk stems from Ethernet’s lack of source-MAC authentication. A switch learns a MAC address from frames arriving at an access port, and EVPN distributes that information to other provider edge devices. If a host impersonates a server’s MAC, the resulting advertisement can carry a higher mobility sequence number, leading other leaves to direct traffic for that server toward the spoofing host. The forged route remains trusted until the legitimate host advertises itself again.
Potential consequences include traffic interception, service disruption and extra control-plane load. An attacker may attract traffic destined for the victim, claim its MAC and drop packets, or repeatedly trigger MAC moves that generate BGP updates and forwarding-table changes. The article also warns that an attacker could try to claim the victim’s IP address using gratuitous ARP or unsolicited neighbour advertisements, a step that may not trigger MAC-mobility detection.
Duplicate-MAC protection is not a complete defence. The safeguards generally count moves within a time window on each individual PE, so activity can remain below the alert threshold or be spread across several switches. Even when an alert is raised, it may identify a duplication event without indicating that it could be malicious.
Route reflectors can provide a broader view because they receive EVPN Type-2 route updates. Operators can export those updates using the BGP Monitoring Protocol and track MAC addresses, originating devices, sequence numbers, sticky flags and timestamps. Useful warning signs include unusually frequent moves over longer periods, sequence-number jumps greater than one, unexpected sticky routes, and conflicting advertisements for the same MAC.
That control-plane monitoring should be checked against access-layer records, including DHCP snooping bindings, 802.1X sessions and port inventories. The article also identifies port MAC limits, ARP/ND inspection and sticky MAC entries for critical systems as measures that can help restrict which addresses hosts are allowed to use. Its central security concern is that EVPN distributes information learned at the edge, so the fabric’s trust depends on verifying host identity where devices connect.
Sources: APNIC Blog.