While you are troubleshooting network performance issues, you notice that a switch is periodically
flooding all unicast traffic. Further investigation reveals that periodically the switch is also having
spikes in CPU utilization, causing the MAC address table to be flushed and relearned. What is the
most likely cause of this issue?

A.
A routing protocol that is flooding updates

B.
A flapping port that is generating BPDUs with the TCN bit set

C.
STP is not running on the switch

D.
A user that is downloading the output of the show-tech command

E.
A corrupted switch CAM table

Explanation:
Spanning-Tree Protocol Topology Changes
Another common issue caused by flooding is Spanning-Tree Protocol (STP) Topology Change
Notification (TCN). TCN is designed to correct forwarding tables after the forwarding topology has
changed. This is necessary to avoid a connectivity outage, as after a topology change some
destinations previously accessible via particular ports might become accessible via different ports.
TCN operates by shortening the forwarding table aging time, such that if the address is not
relearned, it will age out and flooding will occur. TCNs are triggered by a port that is transitioning
to or from the forwarding state. After the TCN, even if the particular destination MAC address has
aged out, flooding should not happen for long in most cases since the address will be relearned.
The issue might arise when TCNs are occurring repeatedly with short intervals. The switches will
constantly be fast-aging their forwarding tables so flooding will be nearly constant.
Normally, a TCN is rare in a well-configured network. When the port on a switch goes up or down,
there is eventually a TCN once the STP state of the port is changing to or from forwarding. When
the port is flapping, repetitive TCNs and flooding occurs.
Ports with the STP portfast feature enabled will not cause TCNs when going to or from the

forwarding state. Configuration of portfast on all end-device ports (such as printers, PCs, servers,
and so on) should limit TCNs to a low amount. Refer to this document for more information on
TCNs:
Understanding Spanning-Tree Protocol Topology Changes Note: In MSFC IOS, there is an
optimization that will trigger VLAN interfaces to repopulate their ARP tables when there is a TCN
in the respective VLAN. This limits flooding in case of TCNs, as there will be an ARP broadcast
and the host MAC address will be relearned as the hosts reply to ARP.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801d0808.
shtml