What is LACP?

Understanding LACP

LACP (Link Aggregation Control Protocol) is a standards-based protocol that dynamically bundles multiple physical Ethernet links between two devices into a single logical link, called a Link Aggregation Group (LAG) or EtherChannel. Defined originally in IEEE 802.3ad and now part of IEEE 802.1AX, it increases bandwidth and provides redundancy if individual links fail.

It works by exchanging LACP Protocol Data Units (LACPDUs) between the two ends. The devices negotiate which compatible links can join the bundle, agree on parameters, and continuously monitor link health. Traffic is distributed across the member links using a hashing algorithm based on fields such as source/destination MAC or IP addresses, keeping individual flows on one link to preserve packet order. If a member link fails, LACP detects it and redistributes traffic over the remaining links without manual intervention. Both ends must run LACP (active/passive modes) for dynamic aggregation, as opposed to static, manually forced bundling.

It matters for security and reliability because it strengthens availability and removes single points of failure in critical paths — between switches, to servers, and to storage. By aggregating links it also avoids the loop and convergence problems that arise from running parallel cables under spanning tree. From a hardening standpoint, LACP should be configured only on intended, trusted ports, since negotiation behavior on unsecured ports could be manipulated, and misconfiguration can cause unexpected forwarding paths.

For example, a data center connects a top-of-rack switch to a core switch with four 10-Gigabit links configured as an LACP LAG. The result is a single 40-Gbps logical link that load-balances traffic across all four cables. When one fiber is accidentally cut, LACP removes that member and shifts its traffic to the surviving three links within seconds, so applications keep running at reduced capacity instead of losing connectivity entirely.