One switchport showing ~2000 MAC addresses, none of which actually exist

[ff_djimenez]

We have noticed recently that there is one switchport that will show TONS of MAC addresses, many more than could be possible. The client connected to that port is a 2017 MacBook Pro, connected to LAN through a BenQ monitor w/ a built-in NIC. Shut/no shut-ing the port clears the mac address table entries, but eventually (within a day or two) the entries will creep back up. I have no idea why this might be happening, other than a faulty NIC in the monitor. Has anyone seen this before or have an idea what's going on here? Here is a small section of the `sh mac address-table` output:

 20    0000.0000.0001    STATIC      Gi3/0/11
  20    0000.0000.0002    STATIC      Gi3/0/11
  20    0000.0000.0009    STATIC      Gi3/0/11
  20    0000.0000.000c    STATIC      Gi3/0/11
  20    0000.0000.0048    STATIC      Gi3/0/11
  20    0000.0000.007d    STATIC      Gi3/0/11
  20    0000.0000.008d    STATIC      Gi3/0/11
  20    0000.0000.0097    STATIC      Gi3/0/11
  20    0000.0000.00b9    STATIC      Gi3/0/11
  20    0000.0000.00bc    STATIC      Gi3/0/11
  20    0000.0000.00cb    STATIC      Gi3/0/11
  20    0000.0000.00f3    STATIC      Gi3/0/11
  20    0000.0000.0130    STATIC      Gi3/0/11
  20    0000.0000.0164    STATIC      Gi3/0/11
  20    0000.0000.0275    STATIC      Gi3/0/11
  20    0000.0000.0278    STATIC      Gi3/0/11
  20    0000.0000.0331    STATIC      Gi3/0/11
  20    0000.0000.0361    STATIC      Gi3/0/11
  20    0000.0000.0363    STATIC      Gi3/0/11
  20    0000.0000.0373    STATIC      Gi3/0/11
  20    0000.0000.0377    STATIC      Gi3/0/11
  20    0000.0000.0402    STATIC      Gi3/0/11
  20    0000.0000.0436    STATIC      Gi3/0/11
  20    0000.0000.0461    STATIC      Gi3/0/11
  20    0000.0000.0462    STATIC      Gi3/0/11
  20    0000.0000.0464    STATIC      Gi3/0/11
  20    0000.0000.046d    STATIC      Gi3/0/11
  20    0000.0000.0470    STATIC      Gi3/0/11
  20    0000.0000.055f    STATIC      Gi3/0/11

[Leo Laohoo]

I'm not certain, but that so-called "LAN port" is actually a mechanism for the monitor to form a "wall" and it's not meant to be connected to switch?

[Richard Burts]

As I was reading the description in this post I was developing a theory that the host was ARPing for every destination that it wanted to access (perhaps misconfigured default gateway). But when I looked at the output I see that these entries are static entries and so not the result of ARP from the host. I do not have a good theory about what creates these static entries.

HTH

Rick