ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] duplicate frames captured by tcpdump

From: Manolis Katsidoniotis <manoska@xxxxxxxxx>
Date: Wed, 14 Jan 2015 23:00:05 -0600
Hello

This is a long shot my apologies if the question is not directly related to this forum.

In our lab we use (linux) tcpdump to capture frames (using interface "any" for applications that do not communicate internally) and wireshark to view and process the captured frames.

Lately after some upgrades we've been noticing the same frame is captured twice, once including the vlan tag and once with the tag stripped (actually sometimes we've noticed several repeated frames)

Does anyone happen to know how we can eliminate this
a. either during capture (via linux tcpdump) or
b. during display (take out the duplicate frames)?

thanks
Manolis