Wireshark mailing list archives
Re: de-duplicate packets by capture filter
From: Guy Harris <guy () alum mit edu>
Date: Mon, 28 Nov 2011 22:10:42 -0800
On Nov 28, 2011, at 9:50 PM, Andrej van der Zee wrote:
If they're *not* bit-for-bit identical, and, for example, the source or destination MAC addresses differ, you might be able to use that.I forgot to mention that from IP-level the packets are identical.
And, I assume, at the Ethernet level they're *not* identical, presumably by having different source and/or destination MAC addresses.
I am just trying to understand first how one IP address can be mapped to multiple Ethernet II MAC-addresses.
By having a machine with multiple network interfaces on the same LAN segment and having its ARP implementation spit out different MAC addresses to different clients as a form of load balancing? :-) Or by having the switch do other weird stuff internally? What's the switch set up to do that causes it to duplicate the packets? What is it doing to the MAC addresses? ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- de-duplicate packets by capture filter Andrej van der Zee (Nov 28)
- Re: de-duplicate packets by capture filter Guy Harris (Nov 28)
- Re: de-duplicate packets by capture filter Andrej van der Zee (Nov 28)
- Re: de-duplicate packets by capture filter Guy Harris (Nov 28)
- Re: de-duplicate packets by capture filter Andrej van der Zee (Nov 28)
- Re: de-duplicate packets by capture filter Andrej van der Zee (Nov 28)
- Re: de-duplicate packets by capture filter Guy Harris (Nov 28)