Message-ID: <E74B412A1B5FD211AD6C0000F87C38ADBC6276@ozyexc1.itg.qvar.cpqcorp.net> From: Matt Muggeridge <Matt.Muggeridge@compaq.com> Subject: RE: [tcptrace] Hardware duplicate? Date: Mon, 27 May 2002 11:36:17 +1000
This occurs when tcptrace sees exactly the same packet more than once.
My configuration was using a switched LAN, which normally bridges each port.
So to run an indpendent sniffer requires port mirroring.
I saw these when I had connected a sniffer (tcpdump) on a port (port Z say)
which was configured as the mirror. The two systems under test were
connected to ports (A and B say) that I configured to mirror their data on
port Z. This meant that when packets arrived at port A they were mirrored
to port Z. It also meant when that same packet arrived at port B, it was
also mirrored to port Z. Thus duplicate packets were captured on my
sniffer. I was extremely grateful that tcptrace had the smarts to deal with
hardware duplicates, otherwise my data would have been very misleading.
(Thankyou!) I corrected the problem by taking port B out of the mirror.
Matt.
>-----Original Message-----
>From: Raffaele Bruno [mailto:raffaele.bruno@guest.cnuce.cnr.it]
>Sent: Monday, 27 May 2002 1:57 AM
>To: tcptrace@masaka.cs.ohiou.edu
>Subject: [tcptrace] Hardware duplicate?
>
>
>Hello,
>
>may ssomeone explain to me the exact meaning of "hardware
>duplicates" in
>the tcptrace? which are the possibe causes of these hardware duplicates
>and how they affect the correctness of the Time Sequuence graphs?
>
>Thanks a lot,
>Raffaele Bruno
>
>
>---------------------------------------------------------------
>-------------
>To unsubscribe, send a message with body containing
>"unsubscribe tcptrace" to
>majordomo@tcptrace.org.
>
----------------------------------------------------------------------------
To unsubscribe, send a message with body containing "unsubscribe tcptrace" to
majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 05/27/02 EDT