VLAN Traffic being sent to many ports

Question

I noticed (based on activity lights) that VLAN traffic between two switch ports are being sent to many switch ports. Heres my scenario:

Port 1 is a "mode access" switchport for VLAN 100 (untagged 100).

Port 2 is a "mode access" switchport for VLAN 101 (untagged 101).

Port 5 is a trunk for VLAN 100 and VLAN 101 (tagged 100, tagged 101).

I have the host on Port 1 talking to the host on Port 2. When they are talking to each other (Unicast), I see port 1, 2, and 5 light up, indicating that its also sending the unicast traffic to port 5. Why is it sending traffic to port 5 when the switch is fully capable of figuring out that the hosts are on Port 1 and Port 2?

My understanding in the past with switches is that it builds a CAM table of mac addresses it sees on ports. It's CAM table should tell the switch that the source and destination hosts are on Ports 1 and 2. Theres no reason it should also go to 5 since there is no host there.

Here is my config:

interface vlan 100
 ip address dhcp
!
interface vlan 101
!
interface ge1
 switchport mode access
 switchport access vlan 100
!
interface ge2
 switchport mode access
 switchport access vlan 101
!
interface ge5
 switchport trunk allowed vlan add 100,101
!

Answer 1

Why is [the switch] sending traffic to port 5 when the switch is fully capable of figuring out that the hosts are on Port 1 and Port 2?

A switch is not capable of figuring out that hosts in two different vlans are communicating with each other.

Only a device such as a router is capable of routing traffic between two vlans.

In this case, you probably have a configuration called "router on a stick" :

The only way for two hosts in two different vlans to communicate with each other is via the router, over a trunk (connection carrying several different vlans) which in your case seems to be connected to port 5.

All traffic from the host on port 1 to the host on port 2 is initially tagged with vlan 100, leaves the switch via port 5, out to the router where it gets vlan 101 assigned to it, then goes back to the switch and only then it can leave port 2. And vice versa.

Answer 2

VLANs create isolated segments. The only way anything on port 1 (vlan 100) can talk to anything on port 2 (vlan 101) is for something in both VLANs (port 5) to pass the traffic along. I'll go out on a (very short) limb and say there's a router on port 5 that's handling inter-vlan traffic.

(note: the switch has a dynamic address on vlan 100 and no address on vlan 101, so it isn't the router)

Answer 3

The traffic you see on port 5, is most likely just broadcast traffic, like ARP, generated from the clients. The CAM table only function as a port <-> MAC address mapper, so the switch knows where to send the frames. I would advise you, to do a packet capture, if you are suspects anything unusual.