Wireshark-users: Re: [Wireshark-users] Terminal Server traffic

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Sun, 16 Mar 2008 13:37:03 -0400
Albert Jurado wrote:
I've attached a small capture file.  Maybe someone can take a look at it and make something of it.

If you look for the following ip address (10.10.10.23) you'll should see the out of order packets.


Albert,
They are the same packets. Notice the IP ID field, you have duplicates. Basically, you captured it twice. Chances are, you spanned the entire vlan and you captured it as it came out of one server and entered the other server.


--

Thanks,
Hansang