Yesterday the flooding control on the cisco 2950t switch kicked in so I had a look at the bandwidth graphs using CNA. Usually we get around 1-2mbit/s of our own traffic, but it was up to 18mbit/s.
Port statistics shows that the switch is mostly receiving unicast traffic, none of which is transmitted of the fabric.
Adding an ACL to the port with our providers uplink to block all but traffic coming from my home IP shows that all of the incoming traffic was not destined for any of our servers as it still kept coming.
Spanning the port to a machine on the net and using tcpdump showed that every packet had a destination IP which was not in our block but was rather destined or sourced from an IP somewhere else on our providers network.
Contacting our provider, they said that there's not much they can do short of allocating our own VLAN (which would involved renumbering).
My question really is that how are unicast packets with a different destination still ending up at my switch. I can understand multicast and broadcast. Also, would this be a routing issue within my providers network or is this just something everyone has to live with?