Hello, Ia have the following setup:
A host is capturing all traffic off its ethernet interface in promiscuous mode, with a capture filter which excludes locally generated or destined traffic, practically it removes all traffic that the host makes. Taking into consideration that host A is on a switched network i expected to see only broadcast and mutlicast traffic on the wire. The surprise came when i noticed that around 0.8% of the traffic was TCP, originated and destined from different ip and mac addresses from the host that was making the capture. Is this capture normal for a switched network or not? Could this be unknown unicast traffic flooded my port? _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
