Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Capturing on Linux interface any

From: "Abhik Sarkar" <sarkar.abhik@xxxxxxxxx>
Date: Fri, 14 Nov 2008 12:42:22 +0100
Hello All,

I have noticed that when a capture is performed on a Linux host on
interface 'any' and that system has bonded interfaces, there are a lot
of TCP duplicates and out-of-order packets reported. It seems it is
because the packets are captured twice... once from the bondX
interface and one from the physical interface. However, this seems to
happen only for outgoing packets. For incoming packets, I assume they
are captured only on the physical interface. Can someone point me to a
source where I might find an explanation of this behaviour?

Thanks,
Abhik.