It appears that a switch is sending the same traffic to all ports in a VLAN:
- In a Wireshark capture on host 192.168.0.10 with MAC aaaa.aaaa.aaaa I see packets with MAC destination bbbb.bbbb.bbbb and Destination IP 192.168.0.20
ARP table on the switch contains a correct entry for 192.168.0.20, listing MAC of bbbb.bbbb.bbbb.
mac address-table entries, however, are missing bbbb.bbbb.bbbb.
After restarting the device, the MAC address table entry gets re-created.
EDIT: Whilst this 'flooding' (is this actually flooding?) is happening, the device 192.168.0.20 continues to function well on the network! It is successfully transferring data. This is an important point: the device with MAC bbbb.bbbb.bbbb continues to send frames with source MAC bbbb.bbbb.bbbb to the switch. The switch is meant to save that MAC into its mac address table. But it doesn't!
What behaviour are we seeing here? Isn't the switch meant to flood the packets with destination MAC ffff.ffff.ffff, forcing the clients to read the packet contents to see if they are meant for them?
Also, I would greatly appreciate any advice on what other checks I can perform.