Fired up my new network analyser today to start looking under the hood. I was surprised to see lots of unicasts between different hosts. I was expecting broadcasts and multicasts, and maybe a stray unicast because of ARP table timeout. But I am seeing many unicast packet conversations between the same hosts.
Thought layer two switches were not suppose to send packets except to the port where the mac address was detected.
I don't have port spanning on - not yet. Have a pretty small network with low utilization. Not anywhere near enough hosts to fill an ARP table. Any ideas about why Cisco layer two switches are flooding out unicasts?
