Wireshark · Ethereal-users: [Ethereal-users] Switch span feature and filtering duplicate packets

["Dent, Greg" <Greg.Dent@xxxxxxxxxx>]

Title: Switch span feature and filtering duplicate packets

When I set up span on a Cisco switch where the source is both the server and client ports, I see duplicate packets - this is a good thing because I can see the packet ingress to one port and egress from the other (I know the switch is working and how long the packet is delayed in the switching path). Unfortunately capture utilities will mark the second packet as a retransmission or duplicate which makes it harder to see real retrans and dups. Is there a way to write a filter or some other method to remove the "normal" retrans and dups and leave the real ones? Sometimes I work on capture files that cannot be easily recreated.

Thanks,
Greg