We have a syslog server on our network that is used by a lot of clients (cisco, linux boxes) for remote logging. I was looking at network traffic and noticed that the syslog traffic was showing up on my desktop interface. This is one way udp traffic from the host to the server. I am on a switched network, so I do not understand how I can see this traffic. The switch should not let this through on all ports. It is like the switch is acting like a hub. Is there any explanation for this? I do not see any other hosts to host traffic only syslog, brodcast and traffic destined for my pc. Also, it seems that the traffic shows up in bursts. It is not there all the time.
Tcpdump output looks like this:
16:05:52.846444 IP 198.XXX.XXX.1.syslog > 198.XXX.XXX.7.syslog: UDP, length 124