I have a bridge set up on a Ubuntu box using two ethernet devices. It seems to work, but I am trying to understand some network traffic, and why these show up in my dhcp client list (/var/lib/dhcp/ is empty) in addition to the box's ip address. Also, I seem to have traffic originating from various mac addresses, which I was not expecting.
brctl showmacs br0 lists 16 unique mac addresses, and that is not making sense to me. I've read these non-local addresses might correspond to other devices, VMs, etc., on the network that pass traffic through the bridge? But I've looked at a couple of these mac addresses on the bridge (which show traffic on my network edge), and I cannot trace them back to a device on my network. The network is small, and I believe all devices are accounted for.
So how many mac addresses should I expect to see associated with a bridge?