We have a mac filter on a port of a Cisco 3560. That port connects to the uplink port of a 4-port unmanaged switch. It works great.
Today, a different 4-port switch was connected. I would expect that no traffic would pass since the mac address is wrong. Sure enough, the clients of the little 4-port switch could not communicate. So far, so good.
But I monitor the incoming communication on the filtered port on our 3560. And while the clients could not connect, I was still seeing a small amount of switch-to-switch communication occurring.
Shouldn't ALL communication be dropped when the mac filter is engaged? Why wasn't my graph a flat line? True, there wasn't much, but it wasn't zero. Why not?