Wireshark-users: Re: [Wireshark-users] wireless lan packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 25 Mar 2008 03:22:43 +0100
On Mon, Mar 24, 2008 at 02:39:52PM -0400, Albert Jurado wrote:
 
First of all, please don't reply to an existing message to start a 
new thread. It will mess up the threading in a lot of mail-readers.
It's better to just create a new message...

> I was wondering.  I'm capturing packets from our server VLAN and 
> I'm seeing a lot of duplicate packets.  

Are you spanning the server vlan selecting "both directions" to 
another port? If so, you will indeed see every packet twice. Once 
when it ingresses the vlan and once when it egresses the vlan.
You can solve this by only spanning incoming packets.

> Is there a way to filter out those duplicate packets by IP ID?

If they are *exactly* the same, then "editcap -d" is your friend.

Cheers,
    Sake