On Mon, Mar 24, 2008 at 02:39:52PM -0400, Albert Jurado wrote:
First of all, please don't reply to an existing message to start a
new thread. It will mess up the threading in a lot of mail-readers.
It's better to just create a new message...
> I was wondering. I'm capturing packets from our server VLAN and
> I'm seeing a lot of duplicate packets.
Are you spanning the server vlan selecting "both directions" to
another port? If so, you will indeed see every packet twice. Once
when it ingresses the vlan and once when it egresses the vlan.
You can solve this by only spanning incoming packets.
> Is there a way to filter out those duplicate packets by IP ID?
If they are *exactly* the same, then "editcap -d" is your friend.
Cheers,
Sake