Hello,
Ia have the following setup:
A host is capturing all traffic off its ethernet interface in
promiscuous mode, with a capture filter which excludes locally
generated or destined traffic, practically it removes all traffic that
the host makes.
Taking into consideration that host A is on a switched network i
expected to see only broadcast and mutlicast traffic on the wire. The
surprise came when i noticed that around 0.8% of the traffic was TCP,
originated and destined from different ip and mac addresses from the
host that was making the capture.
Is this capture normal for a switched network or not?
Could this be unknown unicast traffic flooded my port?
