Are you capturing packets on a span-port? If so, do you span a vlan? Please note that every packet enters the switch and leaves the switch on a vlan, so if you capture packets in both directions when spanning a vlan, you will see every packet twice. The remedy is to either span a specific port in both directions or span a vlan and use only the incoming packets.
Cheers,
Sake
On 12 apr 2010, at 09:48, Manu wrote:
> Yes I see every packet twice.
>
> Nic is Broadcom BCM5716C
>
> Wireshark version :
>
> Version 1.2.6 (SVN Rev 31702)
> Compiled with GTK+ 2.18.5, with GLib 2.22.3, with WinPcap (version unknown),
> with libz 1.2.3, without POSIX capabilities, without libpcre, with SMI
> 0.4.8,
> with c-ares 1.7.0, with Lua 5.1, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with
> MIT
> Kerberos, with GeoIP, with PortAudio V19-devel (built Jan 27 2010), with
> AirPcap.
>
> Running on Windows Server 2003 Service Pack 2, build 3790, with WinPcap
> version
> 4.1.1 (packet.dll version 4.1.0.1753), based on libpcap version 1.0 branch
> 1_0_rel0b (20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.
>
>
> Hope it will help
>
> ----- Original Message -----
> From: "Ian Schorr" <ian.schorr@xxxxxxxxx>
> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
> Sent: Friday, April 09, 2010 11:23 AM
> Subject: Re: [Wireshark-users] strange ping behavior
>
>
>>
>> It's true for ALL received traffic? Including broadcasts? What kind
>> of NIC are you using? What version of Winpcap?
>>
>> -Ian
>>
>> On Fri, Apr 9, 2010 at 4:34 PM, Manu <traqueur@xxxxxxxxxxxxxxxx> wrote:
>>> Yes it's exactly that.
>>>
>>> 3 pings give 6 packets and it's the same for every communication. How
>>> could
>>> it be mirrored ? By NIC ?
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>
>> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
