Re: de-duplicate packets by capture filter

[Guy Harris <guy () alum mit edu>]

On Nov 28, 2011, at 9:50 PM, Andrej van der Zee wrote:

> > If they're *not* bit-for-bit identical, and, for example, the source or destination MAC addresses differ, you might 
> > be able to use that.
>
> I forgot to mention that from IP-level the packets are identical.

And, I assume, at the Ethernet level they're *not* identical, presumably by having different source and/or destination 
MAC addresses.

> I am
> just trying to understand first how one IP address can be mapped to
> multiple Ethernet II MAC-addresses.

By having a machine with multiple network interfaces on the same LAN segment and having its ARP implementation spit out 
different MAC addresses to different clients as a form of load balancing? :-)

Or by having the switch do other weird stuff internally?  What's the switch set up to do that causes it to duplicate 
the packets?  What is it doing to the MAC addresses?
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe