Wireshark · Wireshark-users: Re: [Wireshark-users] newbie question about tcp three-way handshaking

[温金超 <wenjinchao0418@xxxxxxxxx>]

Hi,

I got it. Thanks a lot.

jinchao

2013/1/23 Jaap Keuter <jaap.keuter@xxxxxxxxx>

Well, then obviously you are capturing *below* the bonded interface. Therefore
the *outgoing* frames are seen twice, one for each physical interface, and the
*incoming* frames once, because they come from a switch, which uses a single
port to send the frame[*].

You can't really fall back to capturing a single physical interface (eth0, eth1)
because you do not know where the switch will send the returned frames. To get
rid of the duplicates you can either:

1) capture on the bonding interface (bond0 or whatever name it takes)

2) use editcap -d to remove the duplicates from the capture file afterwards.


[*] unless flooding, multicast, MAC table miss.