Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this traffic. It's not doing anything with it tho, it just sees it.
When I run tcpdump I see that the source and target of the mysql packets are server B and server C. Never server A.
12:52:44.482026 IP $IP_server_B.3306 > $IP_server_A.38662: Flags [.], seq 15905879:15911671, ack 8910, win 62, options [nop,nop,TS val 237711415 ecr 331318504], length 5792
I've double checked the script that send over the dump, the IP of server A is nowhere in that. I've checked if there are IP conflicts - none. The interfaces on all 3 machines have different MAC adresses (just wanted to rule out everything). I can reproduce the behavior on these machines 10 out of 10 times.
All 3 machines are virtual CentOS 6 x64 installations. Server A & B are in the same subnet, server C is in a completely different datacenter and network. Note: Server A & B are in the same subnet, but are not running on the same physical hypervisor.
So.. the question is: how on earth does server A see that traffic?