Wireshark-users: [Wireshark-users] editcap and duplicate removal
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Phillip Heller <pheller@xxxxxx>
Date: Fri, 19 Dec 2008 18:59:14 +0100
So I have a vlan spanned on a Cisco 3560, and did not specify rx or tx, so it therefore defaults to snooping both, resulting in duplicate packets.
I ran editcap -d against the capture file, which did remove the duplicates -- but only in one direction!
This specific capture was of a SIP call, and when I open the resultant file, I still see that the SIP and RTP data from my media gateway towards provider is duplicated.
It's not a giant deal, but it makes the RTP media stream playback pretty much suck. 

Anyone else run into this?

--phil