I'm not picturing the Cisco model in paticular you're describing but lately Cisco has pumped out a bunch of vertical market specific stuff (did you get a model #?). What I suspect it might be doing is checking for more than one MAC on any given switchport which indicates someone plugging a hub, switch, AP, etc in.