--- title: Silent Hosts in EVPN Fabrics « ipSpace.net blog | daily.dev description: Silent hosts — nodes that never send traffic — cause MAC address flooding in EVPN fabrics because switches cannot learn their MAC addresses. The core issue is... canonical: https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Silent Hosts in EVPN Fabrics « ipSpace.net blog | daily.dev og:description: Silent hosts — nodes that never send traffic — cause MAC address flooding in EVPN fabrics because switches cannot learn their MAC addresses. The core issue is... og:url: https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq og:image: https://api.daily.dev/og/posts/Y3msWIFRQ.png og:image:alt: Silent Hosts in EVPN Fabrics « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Silent Hosts in EVPN Fabrics « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 5 min read · 0 upvotes · 0 comments ## Summary Silent hosts — nodes that never send traffic — cause MAC address flooding in EVPN fabrics because switches cannot learn their MAC addresses. The core issue is a timing mismatch: when ARP timeouts on routers/switches (e.g., 4 hours on Cisco IOS/Arista EOS, 25 minutes on Nexus OS) exceed MAC address table aging times, flooding occurs. The post distinguishes true silent hosts from 'shy hosts' (long-idle nodes whose caches expire), explains why vMotion with RARP notifications should help rather than hurt, and notes that slow EVPN control plane implementations (up to 2 seconds to advertise a new MAC) can cause flooding during vMotion. The fundamental fix is ensuring MAC address entries time out later than ARP entries. A workaround using periodic NMAP scans to trigger ARP refreshes is also explained. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does traffic get flooded in an EVPN fabric when silent hosts are present? Flooding occurs when MAC address table aging times are shorter than ARP cache timeouts. Silent hosts never send traffic, so switches cannot learn their MAC addresses dynamically. When the MAC entry ages out but the ARP entry on the sender still maps to that MAC, traffic is flooded across the fabric. Cisco IOS and Arista EOS age ARP entries in 4 hours; Cisco Nexus OS in 25 minutes — far longer than typical MAC aging timers. _Network engineers troubleshooting EVPN flooding track ARP and MAC aging interactions on daily.dev._ ### What ARP timeout does Linux use by default and how does it affect silent host detection? Linux defaults to a 30-second ARP timeout (randomized to 15–45 seconds), and the kernel removes stale entries without incoming traffic every 60 seconds. This means ARP entries for silent hosts become stale almost immediately and are refreshed roughly every two minutes — making Linux hosts much better at triggering ARP re-discovery than routers or switches with multi-hour ARP timeouts. _Engineers tuning EVPN fabric behavior for VMware workloads share findings like these on daily.dev._ ### Why does running NMAP scans on a VLAN help prevent flooding caused by silent hosts in EVPN? Periodic NMAP scans from a Linux host on the same VLAN trigger ARP requests because Linux's short ARP cache timeout (30 seconds, stale entries cleared every 60 seconds) causes entries to expire between scan runs. Those ARP requests prompt silent hosts to respond, allowing leaf switches to learn and advertise their MAC addresses via EVPN before the MAC table ages out, preventing flood conditions. _Workarounds and root-cause analyses for EVPN edge cases like this surface regularly on daily.dev._ ## Similar posts on daily.dev - [When ARP Goes Wrong: Threat Hunting ARP Poisoning in Network Traffic](https://daily.dev/posts/when-arp-goes-wrong-threat-hunting-arp-poisoning-in-network-traffic-cr9xr7c4h) · InfoSec Write-ups · 1 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Silent Hosts in EVPN Fabrics « ipSpace.net blog","url":"https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq"},"datePublished":"2026-08-11T08:56:12.385Z","dateModified":"2026-08-11T09:32:28.056Z","description":"Silent hosts — nodes that never send traffic — cause MAC address flooding in EVPN fabrics because switches cannot learn their MAC addresses. The core issue is...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Silent Hosts in EVPN Fabrics « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/silent-hosts-in-evpn-fabrics-ipspace-net-blog-y3mswifrq#faq","mainEntity":[{"@type":"Question","name":"Why does traffic get flooded in an EVPN fabric when silent hosts are present?","acceptedAnswer":{"@type":"Answer","text":"Flooding occurs when MAC address table aging times are shorter than ARP cache timeouts. Silent hosts never send traffic, so switches cannot learn their MAC addresses dynamically. When the MAC entry ages out but the ARP entry on the sender still maps to that MAC, traffic is flooded across the fabric. Cisco IOS and Arista EOS age ARP entries in 4 hours; Cisco Nexus OS in 25 minutes — far longer than typical MAC aging timers. Network engineers troubleshooting EVPN flooding track ARP and MAC aging interactions on daily.dev."}},{"@type":"Question","name":"What ARP timeout does Linux use by default and how does it affect silent host detection?","acceptedAnswer":{"@type":"Answer","text":"Linux defaults to a 30-second ARP timeout (randomized to 15–45 seconds), and the kernel removes stale entries without incoming traffic every 60 seconds. This means ARP entries for silent hosts become stale almost immediately and are refreshed roughly every two minutes — making Linux hosts much better at triggering ARP re-discovery than routers or switches with multi-hour ARP timeouts. Engineers tuning EVPN fabric behavior for VMware workloads share findings like these on daily.dev."}},{"@type":"Question","name":"Why does running NMAP scans on a VLAN help prevent flooding caused by silent hosts in EVPN?","acceptedAnswer":{"@type":"Answer","text":"Periodic NMAP scans from a Linux host on the same VLAN trigger ARP requests because Linux's short ARP cache timeout (30 seconds, stale entries cleared every 60 seconds) causes entries to expire between scan runs. Those ARP requests prompt silent hosts to respond, allowing leaf switches to learn and advertise their MAC addresses via EVPN before the MAC table ages out, preventing flood conditions. Workarounds and root-cause analyses for EVPN edge cases like this surface regularly on daily.dev."}}]} ```