Back to All Scenarios
PASSEDnetwork / port_flapping
Uplink Port Flapping Between Distribution Switches
A fiber SFP is failing on the uplink between access and distribution layer switches. The port flaps every 30-90 seconds, causing MAC table instability and intermittent connectivity for 200+ users.
Pattern
PORT_FLAPPING
Severity
CRITICAL
Confidence
85%
Remediation
Remote Hands
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | PORT_FLAPPING | PORT_FLAPPING | |
| Severity Assessment | CRITICAL | CRITICAL | |
| Incident Correlation | Yes | 48 linked | |
| Cascade Escalation | Yes | Yes | |
| Remediation | — | Remote Hands — Corax contacts on-site support via call, email, or API |
Scenario Conditions
10G fiber uplink between access and distribution switch. Failing SFP module. 200+ users on downstream access ports. HSRP active on distribution pair.
Injected Error Messages (3)
port flap detected on Te1/0/1 — link state change count: 23 in last 10 minutes, carrier transitions exceeding threshold, interface up down cycling
link flap on upstream causing intermittent gateway unreachability, port bouncing on distribution switch uplink
DHCP service intermittent due to link state changes on upstream — client lease renewals failing during port flap events
Neural Engine Root Cause Analysis
The distribution switch Dist-SW1 is experiencing severe port flapping on its critical uplink interface Te1/0/1, with 23 link state changes in 10 minutes. This indicates either a physical layer issue (bad cable, SFP, or port), duplex/speed mismatch, or upstream device problems. The 18 correlated incidents suggest this uplink failure is causing widespread network connectivity issues downstream, creating a cascade effect across multiple services and devices that depend on this distribution switch for connectivity.
Remediation Plan
1. Immediately check physical connections - reseat cables and SFPs on both ends of Te1/0/1. 2. Verify interface configuration matches on both sides (speed, duplex, VLAN config). 3. Check for CRC errors, input/output errors on the interface. 4. Test with known good cable and SFP modules. 5. If software issue suspected, reload interface configuration or perform switch reload as last resort. 6. Coordinate with upstream device team to check their side of the link. 7. Monitor error counters and implement temporary redundant path if available.
Tested: 2026-03-30Monitors: 3 | Incidents: 3Test ID: cmncjc5be0072obqe67qnu4h7