I have a MikroTik 951G-2HnD running 6.32.3 which is connected via ether1 to a network with VLANs.
On one of the VLANs there is a lot of traffic to other MAC addresses, not destined to this router.
(you could think of it as connected to a hub or to the monitoring port of a switch)
Now, in the interfaces screen this traffic is seen and counted, both on the ether1 interface and the VLAN interface where
this traffic is occurring (not on the other VLAN interface on the same port).
It probably incurs CPU overhead to handle this.
Is this normal? It seems like the interface is always in promiscuous mode.
I think an ethernet chip has hardware-based MAC filtering that normally discards all traffic to other destinations without
even bothering the CPU with it.
The port is not part of a bridge (it has been, but this has been undone and the router has been rebooted after that), and
there is no packet capture running. I would expect to see only the traffic that is actually to the MAC address of the
router or some broadcast/multicast MAC address. However, it sees traffic no normal MAC addresses as well.
(I did a packet trace to confirm that the traffic is to other addresses, IP is in the same subnet)
Is this normal? Is there some place where a “promiscuous mode” checkmark is present that I overlooked?