windows_exporter/docs/runbooks/windowsnetworkinterfaceflapping.md

title

title
WindowsNetworkInterfaceFlapping

Meaning

The operational status of the interface nic changed more than twice within the rate window, and did so for two minutes. The alert counts the changes of windows_net_nic_operation_status{status="up"} between 1 and 0.

Impact

Every transition drops the connections that use the interface and triggers route, DHCP and DNS registration changes. A flapping uplink on a server causes intermittent application failures that are hard to attribute.

Diagnosis

1. Inspect windows_net_nic_operation_status for the interface to see the status it flips to; down and lower layer down point at the link, dormant at authentication such as 802.1X.
2. Check the System event log for NDIS, the adapter driver and Microsoft-Windows-NetworkProfile events, and the switch port for link state changes, errors and port security actions.
3. Check the cable, SFP, speed and duplex negotiation, and whether a teaming or failover configuration switches between members.
4. On virtual machines, check the hypervisor for virtual switch changes, live migrations, or a host adapter that flaps.

Mitigation

Replace the cable or transceiver, fix the speed and duplex settings, update the adapter driver, or correct the switch port and authentication configuration. Exclude an interface that flaps by design, such as a Wi-Fi or VPN adapter, with the nicSelector. Confirm the status stays up.