A technician troubleshooting intermittent unicast flooding on a hospital ward's switch notices that a workstation's MAC address keeps disappearing from the switch's MAC address table between periods of activity, forcing the switch to flood its traffic to every port on the VLAN. What is the most likely explanation?

Switches maintain MAC address table entries with an aging timer, removing an entry if no frame from that source is seen within the timeout period; once an entry ages out, the switch no longer knows which specific port to use for frames destined to that address, so it falls back to flooding those frames out every port in the VLAN until the address is relearned. A workstation with bursty or infrequent traffic patterns can plausibly have its entry age out between bursts, producing exactly the intermittent flooding described, since flooding only occurs in the gap right after an entry expires and before the device transmits again. A wrong VLAN assignment would cause a workstation's traffic to be isolated to the wrong broadcast domain consistently, not cause intermittent flooding tied to timing gaps in its own traffic pattern. A port placed in spanning-tree blocking state would not forward traffic at all in that state, which contradicts the fact that the workstation is clearly communicating, just being flooded to intermittently. An exceeded PoE budget affects power delivery to end devices and has no direct relationship to how or when MAC address table entries age out. A concrete check is comparing the switch's configured MAC aging timer against how frequently the workstation actually transmits, and adjusting expectations or investigating the device's traffic pattern accordingly.