A method, by a network device, for directing traffic through a set of aggregated links during failure of a downstream link, comprising: detecting a downstream failure indicator having a first value in a header of a first frame received with a media access control, MAC, address as its source MAC address, wherein the first value indicates that a downstream link failure has been detected; determining whether the first frame was received on a first set of links or a second set of links; associating the source MAC address and a virtual local area network, VLAN, identifier in the header with the set of links on which the first frame was received; and hashing a plurality of frames on the set of links on which the first frame was received, the plurality of frames having the MAC address as their destination MAC address; wherein the downstream failure indicator can alternatively have a second value, the second value indicating that a downstream link failure has not been detected; and wherein, if the downstream failure indicator has the second value, the following steps are performed by the network device: detecting a downstream failure indicator having the second value in a header of a second frame received with the MAC address as its source MAC address; associating the source MAC address with a parent link aggregation group, LAG, that includes the first set of links and the second set of links; and hashing, on the parent LAG, a plurality of frames having the MAC address as their destination MAC. detecting a downstream failure indicator having a first value in a header of a first frame received with a media access control, MAC, address as its source MAC address, wherein the first value indicates that a downstream link failure has been detected; determining whether the first frame was received on a first set of links or a second set of links; associating the source MAC address and a virtual local area network, VLAN, identifier in the header with the set of links on which the first frame was received; and hashing a plurality of frames on the set of links on which the first frame was received, the plurality of frames having the MAC address as their destination MAC address; wherein the downstream failure indicator can alternatively have a second value, the second value indicating that a downstream link failure has not been detected; and wherein, if the downstream failure indicator has the second value, the following steps are performed by the network device: detecting a downstream failure indicator having the second value in a header of a second frame received with the MAC address as its source MAC address; associating the source MAC address with a parent link aggregation group, LAG, that includes the first set of links and the second set of links; and hashing, on the parent LAG, a plurality of frames having the MAC address as their destination MAC. detecting a downstream failure indicator having the second value in a header of a second frame received with the MAC address as its source MAC address; associating the source MAC address with a parent link aggregation group, LAG, that includes the first set of links and the second set of links; and hashing, on the parent LAG, a plurality of frames having the MAC address as their destination MAC.