Scanning through the information sent so far raises the question of whether you are using some type of EtherChannel bundling for uplinks. If so, and you are only spanning one of the links in the bundle to your Wireshark port, you might see the behavior identified. Depending on the algorithm in use by the switch, you might see traffic in one direction on the link you selected, and not traffic in the opposite direction. If the algorithm does any kind of dynamic allocation, it may explain why it appears that devices are coming and going as they are allocated or removed from the link in the bundle you are watching.
Verify whether you are using a EtherChannel bundling path technology on the switch you are monitoring. If so, you need to monitor all the pipes in the bundle, but watch out for oversubscription of the monitor port you have attached Wireshark to.
Alan Emery
Global Solution Center
1177 S Beltline Road, Coppell, TX 75019
ademery@xxxxxxxxxx