Re: strange ping behavior

[Sake Blok <sake () euronet nl>]

Are you capturing packets on a span-port? If so, do you span a vlan? Please note that every packet enters the switch 
and leaves the switch on a vlan, so if you capture packets in both directions when spanning a vlan, you will see every 
packet twice. The remedy is to either span a specific port in both directions or span a vlan and use only the incoming 
packets.

Cheers,


Sake


On 12 apr 2010, at 09:48, Manu wrote:

> Yes I see every packet twice.
>
> Nic is Broadcom BCM5716C
>
> Wireshark version :
>
> Version 1.2.6 (SVN Rev 31702)
> Compiled with GTK+ 2.18.5, with GLib 2.22.3, with WinPcap (version unknown),
> with libz 1.2.3, without POSIX capabilities, without libpcre, with SMI 
> 0.4.8,
> with c-ares 1.7.0, with Lua 5.1, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with 
> MIT
> Kerberos, with GeoIP, with PortAudio V19-devel (built Jan 27 2010), with
> AirPcap.
>
> Running on Windows Server 2003 Service Pack 2, build 3790, with WinPcap 
> version
> 4.1.1 (packet.dll version 4.1.0.1753), based on libpcap version 1.0 branch
> 1_0_rel0b (20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.
>
>
> Hope it will help
>
> ----- Original Message ----- 
> From: "Ian Schorr" <ian.schorr () gmail com>
> To: "Community support list for Wireshark" <wireshark-users () wireshark org>
> Sent: Friday, April 09, 2010 11:23 AM
> Subject: Re: [Wireshark-users] strange ping behavior
>
>
> > It's true for ALL received traffic?  Including broadcasts?  What kind
> > of NIC are you using?  What version of Winpcap?
> >
> > -Ian
> >
> > On Fri, Apr 9, 2010 at 4:34 PM, Manu <traqueur () club-internet fr> wrote:
> > > Yes it's exactly that.
> > >
> > > 3 pings give 6 packets and it's the same for every communication. How 
> > > could
> > > it be mirrored ? By NIC ?
> > ___________________________________________________________________________
> > Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> > Archives:    http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> >
> > mailto:wireshark-users-request () wireshark org?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe