FULL AI ANALYSIS

Proxmox LXC restores create duplicate MAC addresses causing ARP flaps and intermittent container network loss

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

Proxmox stores the container network MAC (hwaddr) in the LXC config and vzdump backups may include this value. Restoring from backups that preserve hwaddr will create duplicate MACs if multiple containers keep the same hwaddr in the cluster or across hosts. Switches react to duplicate source MACs with constant relearning, causing ARP flaps and packet loss. The correct long-term solution is to ensure restore process either generates unique MACs or assigns new ones post-restore and to clear stale MAC entries on upstream switches.

Possible causes

vzdump backups preserved the hwaddr MAC and the restore process wrote identical hwaddr into multiple container configs.

95%

Operator restore scripts invoked pct restore without generating new network device identifiers.

90%

Upstream switch port-security or lack of CAM aging allows stale entries to persist, worsening collision symptoms.

45%

Cluster config sync restored identical net configs across nodes when restoring backups.

25%

Suggested fixes

1

Diagnostic step 1

Before further restores, modify restore scripts to omit hwaddr from the restored config or pass a flag to pct restore that forces generation of a new MAC. For scripted restores, remove or replace any 'hwaddr:' line in the backup config before writing to /etc/pve/lxc/<id>.conf.

2

Diagnostic step 2

For existing duplicates, pick one container at a time during a maintenance window, set a new MAC using Proxmox GUI or by editing /etc/pve/lxc/<id>.conf net0 entry (e.g., hwaddr: 02:XX:XX:XX:XX:XX), then restart the container network. Use a pattern in locally administered MAC range (02: prefix).

3

Diagnostic step 3

On the physical switch, clear the CAM table entries for affected MACs or bounce the relevant switch ports to force relearning. Coordinate with network admin for managed switches—do not clear entire CAM table in production without authorization.

4

Diagnostic step 4

Implement a post-restore validation script that lists net0 hwaddr for all containers and flags duplicates prior to bringing them online. If you cannot change restore process, run this script immediately after restores and reassign MACs as needed.

5

Diagnostic step 5

If restore process is part of a larger orchestration or involves backups from another cluster, document MAC handling and escalate to the Proxmox administrator owning backup tooling to make the generation of unique MACs mandatory.