According to an example, a stacking device in a distribution layer may monitor traffic in an aggregation link between the stacking device and a core layer. When a traffic unbalance is detected in the aggregation link, the stacking device may find a data flow that causes the traffic unbalance from data flows transferred over the aggregation link and an incoming interface through which the found data flow enters the stacking device. The stacking device may also reallocate a new MAC address to the incoming interface and may send the new MAC address allocated to the incoming interface to a terminal server, so as to enable the traffic unbalance to transit to traffic balance by way of the terminal server sending a data flow with the new MAC address as the destination MAC address.