Dell Networking | eSONiC | How to identify MAC MOVE In SONiC

sonic# show version
Software Version  : 4.2.0-Enterprise_Base

Product           : Enterprise SONiC Distribution by Dell Technologies
Distribution      : Debian 10.13
Kernel            : 5.10.0-21-amd64
Config DB Version : version_4_2_1
Build Commit      : b3aea3ecc9
Build Date        : Wed Nov 29 17:27:27 UTC 2023
Built By          : sonicbld@bld-lvn-csg-06
Platform          : x86_64-kvm_x86_64-r0
HwSKU             : DellEMC-S5248f-P-25G-DPB
ASIC              : vs
Serial Number     :
Uptime            : 15:53:08 up 6:06, 1 user, load average: 1.63, 1.59, 1.60
....omit....

From show logging output we can see the MAC MOVE happening between eth1/1 and e1/2 (their native port number will be ethernet0 and ethernet1), at here we print last 100 line of show logging and filter the MAC-MOVE event.
 

sonic# show logging lines 100 | grep MAC-MOVE

Jan 18 15:54:56.602793+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:54:57.626983+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:54:58.659108+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:54:59.683273+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:00.706108+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:01.722900+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:02.745811+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:03.769154+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:04.790779+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:05.814304+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:06.837769+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:07.851476+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:08.875015+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:09.893013+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:10.913037+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:11.937786+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:12.962441+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:13.990055+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
Jan 18 15:55:15.005593+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 2 to 1
Jan 18 15:55:16.022276+00:00 2024 sonic NOTICE syncd#syncd: :- process_packet_for_fdb_event: MAC-MOVE Detected from 1 to 2
....omit....

sonic#
sonic# show lldp table

------------------------------------------------------------------------------------------------------
LocalPort           RemoteDevice        RemotePortID        Capability          RemotePortDescr
-------------------------------------------------------------------------------------------------------
Eth1/1              almalinux           0c:7b:7a:93:00:00                       eth0
Eth1/2              almalinux           0c:7b:7a:93:00:01                       eth1

sonic#
sonic# show mac address-table interface e1/1

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:00   DYNAMIC       Eth1/1
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/1

sonic#
sonic# show mac address-table interface e1/1

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:00   DYNAMIC       Eth1/1
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/1

sonic# show mac address-table interface e1/1

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:00   DYNAMIC       Eth1/1

sonic# show mac address-table interface e1/1

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:00   DYNAMIC       Eth1/1

sonic# show mac address-table interface e1/1

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:00   DYNAMIC       Eth1/1
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/1
 

sonic# show mac address-table interface e1/2

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:01   DYNAMIC       Eth1/2
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/2

sonic# show mac address-table interface e1/2

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:01   DYNAMIC       Eth1/2

sonic# show mac address-table interface e1/2

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           0C:7B:7A:93:00:01   DYNAMIC       Eth1/2
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/2
sonic#

We move to linux shell to run 'sudo ip monitor neigh' command
 

sonic# exit
admin@sonic:~$ sudo ip monitor neigh

dev Ethernet1 lladdr de:11:de:11:de:11 REACHABLE
dev Ethernet0 lladdr de:11:de:11:de:11 REACHABLE
dev Ethernet1 lladdr de:11:de:11:de:11 REACHABLE
dev Ethernet0 lladdr de:11:de:11:de:11 REACHABLE
dev Ethernet1 lladdr de:11:de:11:de:11 REACHABLE
dev Ethernet0 lladdr de:11:de:11:de:11 REACHABLE
dev Ethernet1 lladdr de:11:de:11:de:11 REACHABLE
^C

admin@sonic:~$ sonic-cli
sonic# show mac address-table address DE:11:DE:11:DE:11

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/2

sonic# show mac address-table address DE:11:DE:11:DE:11

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/1

sonic# show mac address-table address DE:11:DE:11:DE:11

-----------------------------------------------------------
VLAN         MAC-ADDRESS         TYPE         INTERFACE
-----------------------------------------------------------
1           DE:11:DE:11:DE:11   DYNAMIC       Eth1/1
sonic#

That is all , maybe there are many mac address flapping in your case , please use above method to find them out.