Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] wireshark on windows showing duplicates that are not reall

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Fri, 18 Apr 2008 13:23:40 -0400
Bill Meier wrote:
Robert Guthrie wrote:
I did a test that involves 3 computers:
Machine A - Windows IP 9.53.23.38 sending ICMP ping requests
Machine B - Windows IP 9.48.150.77 receiving ICMP ping requests
Machine C - Linux machine on the same bridge as Machine A and can see all traffic to/from Machine A Running wireshark on machine A shows duplicate ping requests. Running wireshark on machine B shows no duplicates, but shows ping requests/replies
Running wireshark on machine C shows no duplicates.

One thing I note:

The destination MAC address of the ping request is
All-HSRP-Routers_01 (00:00:0c:07:ac:01).


(After doing a little research): the use of HSRP destination MAC address is just how the HSRP stuff works so that's probably not particularly relevant.

Instead: Please see http://wiki.wireshark.org/CaptureSetup/InterferingSoftware and check if anything mentioned there is relevant.