I noticed (based on activity lights) that VLAN traffic between two switch ports are being sent to many switch ports. Heres my scenario:

Port 1 is a "mode access" switchport for VLAN 100 (untagged 100).

Port 2 is a "mode access" switchport for VLAN 101 (untagged 101).

Port 5 is a trunk for VLAN 100 and VLAN 101 (tagged 100, tagged 101).

I have the host on Port 1 talking to the host on Port 2. When they are talking to each other (Unicast), I see port 1, 2, and 5 light up, indicating that its also sending the unicast traffic to port 5. Why is it sending traffic to port 5 when the switch is fully capable of figuring out that the hosts are on Port 1 and Port 2?

My understanding in the past with switches is that it builds a CAM table of mac addresses it sees on ports. It's CAM table should tell the switch that the source and destination hosts are on Ports 1 and 2. Theres no reason it should also go to 5 since there is no host there.

Here is my config:

interface vlan 100
 ip address dhcp
interface vlan 101
interface ge1
 switchport mode access
 switchport access vlan 100
interface ge2
 switchport mode access
 switchport access vlan 101
interface ge5
 switchport trunk allowed vlan add 100,101
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 13, 2017 at 20:05

3 Answers 3


Why is [the switch] sending traffic to port 5 when the switch is fully capable of figuring out that the hosts are on Port 1 and Port 2?

A switch is not capable of figuring out that hosts in two different vlans are communicating with each other.

Only a device such as a router is capable of routing traffic between two vlans.

In this case, you probably have a configuration called "router on a stick" :

router on a stick illustration

The only way for two hosts in two different vlans to communicate with each other is via the router, over a trunk (connection carrying several different vlans) which in your case seems to be connected to port 5.

All traffic from the host on port 1 to the host on port 2 is initially tagged with vlan 100, leaves the switch via port 5, out to the router where it gets vlan 101 assigned to it, then goes back to the switch and only then it can leave port 2. And vice versa.


VLANs create isolated segments. The only way anything on port 1 (vlan 100) can talk to anything on port 2 (vlan 101) is for something in both VLANs (port 5) to pass the traffic along. I'll go out on a (very short) limb and say there's a router on port 5 that's handling inter-vlan traffic.

(note: the switch has a dynamic address on vlan 100 and no address on vlan 101, so it isn't the router)


The traffic you see on port 5, is most likely just broadcast traffic, like ARP, generated from the clients. The CAM table only function as a port <-> MAC address mapper, so the switch knows where to send the frames. I would advise you, to do a packet capture, if you are suspects anything unusual.

  • I did a packet capture on port 5 and I do see the packets that were communications between Port 1 and Port 2. I see a lot of TCP Dup ACK and TCP Retransmissions from Wireshark. Not sure what all that means. I assume this is not normal. Mar 27, 2016 at 17:07
  • Also this is unicast traffic that I'm seeing, not broadcast. Mar 27, 2016 at 17:28
  • Sorry, I also updated my question, I messed up the VLAN numbers in my scenario. Mar 27, 2016 at 17:31
  • 1
    What brand is your switch? Csn you please post it's configuration in its entirety?
    – OzNetNerd
    Mar 27, 2016 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.