Re: Observing duplicate frame captures in TCPDUMP

[Andrea Montefusco <andrea.montefusco () kyneste com>]

Kraus, Jeffery wrote:
> Hello All, I have the following version of TCPDUMP and LIBPCAP:
> tcpdump --help
> tcpdump version 3.7.2
> libpcap version 0.7.2
>
>
> Whenever I run captures I always get every packet displayed twice. I have
> seen numerous emails regarding this issue, but no real fix. I am currently
> using eth4 as the capture interface and I do not have an IP address bound to
> it. Any ideas? Thanks.

May be you are connected to a switch port (Cisco Catalyst)
in SPAN/port monitor mode ?
In this case, and if you have selected to monitor a VLAN,
you can see double frames.

  *am*

---------------------------------------------------------
Andrea Montefusco                         Network Manager
Kyneste S.p.A.  Roma Via Mario Bianchini, 68
                Milano Via della Posta, 3
tel: +3906874021 mob: +393356992791 fax: +390687402300
---------------------------------------------------------

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe