We are aware of the issue.
On the evening of March 1st for approximately 15 minutes local German time, and again on the evening of March 3rd for roughly 5 to 10 minutes, we experienced significant network degradation within a specific VLAN. The incident was traced to a highly specific edge case event involving the factory default hardware timers on our Arista core routing infrastructure. Given the improbability of this occurring naturally, we have confirmed with a high degree of confidence that this was the result of a deliberate internal attack against our infrastructure exploiting these default settings.
As per standard Arista default configurations, the core routing equipment operates with asynchronous aging timers for Layer 2 and Layer 3 hardware tables. If inbound traffic is routed to an IP address during the specific window where its Layer 3 mapping is still cached, but its Layer 2 egress port has already timed out of the forwarding database, a specific routing behavior occurs. The core router knows the destination MAC address via the ARP cache, but it cannot determine the associated physical exit port. Consequently, the router is forced to treat the traffic as Unknown Unicast, flooding it to all active ports within the VLAN to ensure delivery.
A malicious actor deliberately exploited this asynchronous timer state by directing a high packet-per-second traffic stream toward targeted IP addresses experiencing this specific condition. Because the core infrastructure was forced to replicate this high volume of traffic across the entire VLAN as Unknown Unicast, it led to excessive CPU and network interface loads on unassociated end devices within the same network segment. This replication mechanism also made the initial debugging highly complex, as the traffic appeared as valid Unicast packets to the receiving devices.
The issue has been fully resolved. We have overridden the Arista default settings and synchronized the Layer 3 ARP timeouts with the Layer 2 MAC aging timers across our core infrastructure. This effectively eliminates this timer mismatch scenario as a root cause for Unknown Unicast flooding. Additional measures have been implemented to improve debugging capabilities and strengthen the detection of similar events in the future.
The Issue occurred again 15-20 minutes ago.
Issue has been fixed. Everthing green again. More information on that later.