Why Snort doubles packet number?

["Santi Benito" <benisoroa () gmail com>]

Hi Snorters,
I am replaying with Tcpreplay a file that has 1644419 packets by
eth1.This interface is directly connected to eth1 in another computer
where is running snort.
When I press CTRL+C when the replay has finished, on statistic appear:

Snort received 3288840 packets (this number is just the double of 1644419)
   Analyzed: 3288840(100.000%)
   Dropped: 0(0.000%)

Why occurs this thing?
Thanks a lot!
Santi


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users