False alerts for download

[Nick]

On a low-traffic virtual private server I had monit configured to
alert me on "high" download rates, like so:

   check network ens3 with interface ens3
       if total downloaded > 1.2 MB in last 10 minutes then alert

I had to abandon it due to frequent false alerts.  Monit would report
downloads of many MB, sometimes even going into GB.  By using
"nethogs" I could see that sometimes there is download traffic
exceeding 10MB/s between IP addresses that belong to my VPS provider
but which do not belong to my server.

Apparently this can happen due to "unicast flooding" where packets
from the switch are received at servers other than the intended
recipients because the switch doesn't know the correct MAC address.
I'm not a networking expert and am none too sure how to verify that
it's the culprit in my case.

Is there a way to have monit's notion of download size be one that
excludes these 'alien' packets?

Thanks
-- 
Nick