In a VXLAN overlay without a control plane, what does flood-and-learn mean, and what is BUM traffic?

## The problem a VTEP has to solve A **VXLAN Tunnel End Point (VTEP)** sits between hosts and a routed IP network. A host sends an ordinary Ethernet frame; the VTEP wraps it in an outer IP and UDP header plus an 8-byte VXLAN header carrying a 24-bit **VXLAN Network Identifier (VNI)**, and sends it across the layer 3 underlay to another VTEP, which unwraps it. To do that for a unicast frame, the VTEP must know one thing: **behind which remote VTEP does this destination MAC address live?** There are two families of answers. A **control plane** — a directory, or a routing protocol such as BGP EVPN — can tell every VTEP the mappings before any frame needs them. Or the VTEPs can work it out from the traffic itself. RFC 7348, the Informational RFC that defines VXLAN, describes the second scheme and calls it **data-plane learning**; operators call it **flood-and-learn**. ## The "learn" half When a VTEP receives and decapsulates a VXLAN packet, it reads two addresses: - the **inner source MAC** — the host that sent the original frame; - the **outer source IP** — the address of the VTEP that encapsulated it. It stores `(VNI, inner source MAC) → outer source IP`. The next time one of its own hosts sends a frame to that MAC in that VNI, the VTEP encapsulates it as **one unicast packet** to that VTEP address. RFC 7348 §4.1 states the purpose plainly: the mapping is stored so that the reply needs no "unknown destination" flooding. The VNI is part of the key because RFC 7348 lets different segments reuse the same MAC addresses without traffic crossing over. ## The "flood" half — what counts as BUM Some frames cannot go to a single known VTEP. Together they are called **BUM** traffic: | Letter | Frame | Why it cannot go to one VTEP | |---|---|---| | **B** | Broadcast, such as an ARP request | Every host in the segment must see it | | **U** | Unknown unicast | A unicast MAC with no learned mapping yet | | **M** | Multicast | Any host in the segment might be a receiver | **Known unicast** — a destination MAC the VTEP has already learned, on a local port or behind a remote VTEP — is the only traffic that is *not* flooded. A broadcast is flooded every time, however many mappings the VTEP has learned. ## How a flood reaches the other VTEPs A VTEP floods a BUM frame to **every VTEP that hosts the same VNI**, in one of two ways: 1. **Underlay IP multicast.** RFC 7348 maps each VNI to an IP multicast group (the mapping is supplied by the management layer). VTEPs join the group, and the routed underlay copies the packet along a multicast tree. The source sends one packet. 2. **Ingress replication** (also called head-end replication). The source VTEP holds a list of peer VTEPs for the VNI and sends a separate unicast copy to each. The underlay needs no multicast at all; the source pays in bandwidth. Either way, the receiving VTEPs deliver the frame to their local hosts in that segment — and **learn** from it, because the flooded packet carries the sender's VTEP address as its outer source. ## How the two halves feed each other Consider the very first exchange between two hosts that have never spoken: 1. Host A broadcasts an ARP request for host B's IP address. 2. A's VTEP floods it; every VTEP in the segment learns that A lives behind A's VTEP. 3. B answers with a unicast ARP reply. B's VTEP already knows where A is, so the reply crosses the underlay as one unicast packet. 4. A's VTEP decapsulates the reply and learns where B is. From now on, both directions are known unicast. That is the whole design: **flooding is the discovery mechanism**, and learning makes the flood unnecessary for the rest of the conversation. ## Where the model stops Flood-and-learn needs no protocol between the VTEPs beyond the encapsulation itself; only the VNI-to-group mapping comes from the management layer. The price is that every VTEP in a segment carries every broadcast and every unknown-unicast frame, mappings exist only after traffic has flowed, and a host that moves is relearned only when it next sends. Those costs are why large fabrics replace the learning with a control plane while keeping the same VXLAN encapsulation — RFC 8365 contrasts the two, noting that data-plane learning requires flooding unknown unicast and ARP frames while control-plane learning does not.