MAC explosion is best described as a large amount of MAC addresses being withdrawn and relearned?

In Nokia-SR OS terminology a “MAC explosion” (also called MAC flooding) is the situation in which a bridge learns a very large number of different source MAC addresses in a short time, eventually exhausting the forwarding database. It is characterised by thousands of new, unique MAC addresses being added—​not by the same addresses being repeatedly withdrawn and relearned.

The behaviour in which the same MAC address is continually withdrawn from one port/service and relearned on another is called “MAC move” or “MAC flapping,” not MAC explosion.

Why the Other Option Is Wrong:

• True – Choosing True would equate MAC explosion with the continual withdrawal and relearning of the same MAC addresses. That behaviour is explicitly defined by Nokia documentation as “MAC move/flap,” not MAC explosion; therefore the statement is incorrect.

1. Nokia (Alcatel-Lucent) SR OS Layer 2 Services and Bridging Guide, Release R12.0, Section 7.6 “MAC Flooding (MAC Explosion)”, pp. 342-343: “MAC flooding occurs when a large number of frames with unique source MAC addresses are received … creating an explosion of new MAC entries.”

2. Nokia SR OS Layer 2 Services and Bridging Guide, Release R12.0, Section 7.7 “MAC Move Protection”, p. 350: “MAC move (also called MAC flapping) is the repeated withdrawal and relearning of the same MAC address on different ports/services.”

3. Aalto University, CS-E4180 “Advanced Topics in Networking,” Lecture notes on Layer-2 security, slide 18: distinguishes ‘MAC flooding/explosion’ from ‘MAC flapping’ (single MAC moving between ports).

These sources collectively confirm that MAC explosion involves many new MAC addresses being learned, whereas withdrawal and relearning of the same MAC address describes MAC flapping.