Mitigating effects of flooding attacks on a forwarding database

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a virtualized network device, causes the one or more processors to perform a method comprising:

• facilitating communication between an application associated with a first virtual domain (VDOM) of the virtualized network device and an external network device by:
• creating a sub-interface of a physical Ethernet interface of the virtualized network device;
• assigning a unique Media Access Control (MAC) address to the sub-interface;
• and
• binding the application to the sub-interface;
• when the first VDOM is operating in transparent mode and an ingress packet to be processed by the application is received by an internal switch running on the virtualized network device via the sub-interface, then performing source-MAC learning while mitigating against a source-MAC flooding attack by:
• when an entry, having a MAC address corresponding to a source MAC address of the ingress packet, does not exist in a forwarding database of the virtualized network device:
• causing, by the internal switch, the forwarding database of the virtualized network device to learn an association between the source MAC address and the sub-interface by creating the entry containing the source MAC address and information regarding the sub-interface and storing the entry in the forwarding database;
• queuing, by the internal switch, the entry for confirmation at a tail of an ephemeral queue associated with the physical Ethernet interface;
• and
• when a total number of entries contained in the forwarding database reaches a predetermined threshold, then obsoleting, by the internal switch, an unconfirmed entry at a head of the ephemeral queue by removing the unconfirmed entry from the forwarding database;
• and
• when a packet is observed, by the internal switch, having a destination MAC address matching the MAC address of an entry awaiting confirmation in the ephemeral queue, then recognizing the entry awaiting confirmation as a confirmed entry for retention in the forwarding database and unlinking the confirmed entry from the ephemeral queue.