This counts unicast frames the port received where neither the source nor destination MAC address was already in the port's forwarding table, forcing the frame to be kicked up to the system module for lookup/learning rather than switched directly. An admin watching this metric climb unexpectedly on a stable, well-known segment might suspect MAC address spoofing, a rapidly rotating pool of virtual machines, or a misbehaving NIC generating garbage source addresses. A sustained high rate here also correlates with elevated CPU load since each such frame needs software-path handling.