Looked around, can't find a similar issue anywhere...
I have been having some very strange and hard to explain problems on my network lately, and in my efforts to find the cause, I came across an interesting discovery, which I am struggling to understand.
In my network, there is a router/modem which connects wifi devices to the network, and connects the network to the internet - there is only one network: 192.168.178.0 hosted on the router. There is a simple 8 port un-managed switch connected to the router, and on that switch there are 4 servers, each with static IP setup within their os (mostly running Ubuntu Server 14.04)
Each server has iptables setup to drop all except specific host:port:state combinations.
So here is the issue:
Running tcptrack on serverA (192.168.178.19) shows exactly what I'd expect the traffic to be, except I noticed that there were packets being picked up that were addresses to serverB (192.168.178.13). ServerA was correctly bouncing those packets (SYN_SENT only, never established) - but how did the packet get routed there to begin with...
The blacked out ip is my own external one, but I have seen the issue from another ip too.
So I guess I am asking if this is normal? Or if I have a router problem?
Thanks in advance. Tim