How should it run ?

[hoba]

CARP is the mechnism used to detect the state of machines in a cluster and to swap the macadress back and forth between clustermembers. This traffic will happen on every interface where a carp ip resides.

pfSync is an additional mechanism used to sync the statetables between clustermembers so that already established connections don't need to be reestablished after a failover. This traffic will happen on the interface that you set as sync interface.

Both features do work independently of each other but are often used together.

[jakehathaway]

So what do I look for on the switch as CARP traffic?

[hoba]

See http://www.countersiege.com/doc/pfsync-carp/ for how it works.