Wireshark · Ethereal-users: [Ethereal-users] Removing duplicate frames via ip.id ?

[Barnaby DiAnni <bdianni@xxxxxxxxx>]

Hi,

Is there a way to filter out packets with duplicate IP Identifiers?  

Something along the lines of:

!ip.id.duplicate  ie..  "filter out non uniq ip.id packets" 


Some sniffer captures often arrive with duplicate IP Identification due to
the various ways that traffic can be spanned (mirrored) on a switch.

I'm aware of  

!tcp.analysis.duplicate_ack && !tcp.analysis.retransmission 

to filter these packets at the tcp layer.  But this may filter out valid
retransmissions.

Thank you,

-- 
    Barnaby