I did a tcpdump capture, and when inspecting the reults, I saw some data I couldn't understand.
Say the hostname of the box I did the capture on was box1.blah
I saw traffic like this:
box2.blah:45134 > box3.blah:7802
Now, I know what that traffic is, it's traffic used for the application failover function of HP NNMi, box2 being my primary NNMi box and box3 being my failover box.
I understand that the box1 NIC goes into promiscuous mode when tcpdump is started, but I thought you could only see traffic not addressed to you when using old school hubs, wireless, broadcast or multicast traffic ?
None of these situations are true.
So what's going on?