Re: newbie question about tcp three-way handshaking

[温金超 <wenjinchao0418 () gmail com>]

Hi,

I got it. Thanks a lot.

jinchao

2013/1/23 Jaap Keuter <jaap.keuter () xs4all nl>

> Well, then obviously you are capturing *below* the bonded interface.
> Therefore
> the *outgoing* frames are seen twice, one for each physical interface, and
> the
> *incoming* frames once, because they come from a switch, which uses a
> single
> port to send the frame[*].
>
> You can't really fall back to capturing a single physical interface (eth0,
> eth1)
> because you do not know where the switch will send the returned frames. To
> get
> rid of the duplicates you can either:
>
> 1) capture on the bonding interface (bond0 or whatever name it takes)
>
> 2) use editcap -d to remove the duplicates from the capture file
> afterwards.
>
>
> [*] unless flooding, multicast, MAC table miss.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe