Message-ID: <E74B412A1B5FD211AD6C0000F87C38ADBC627C@ozyexc1.itg.qvar.cpqcorp.net> From: Matt Muggeridge <Matt.Muggeridge@compaq.com> Subject: RE: [tcptrace] Hardware duplicate? Date: Mon, 27 May 2002 21:27:14 +1000
>I capture all the TCP
>packets that arrives
>to the network interface of each nodes.
I haven't traced a wireless network before. I agree, this is a bit more
difficult to understand where the duplicates would be coming from.
Presumably, your just sniffing the air, which by its very nature is a
broadcast media (unlike bridged switched LANs).
I guess the $64M is how do duplicates appear? Could they be real? Do you
see them for every packet or selected packets? Can you perform a link-level
trace?
As far as their impact on the time sequence graph, assuming they are phantom
duplicates, the graph will be unaffected, except for the "HD" symbol. There
are switches to turn off detection of hardware duplicates, in which case
your graph would look quite different.
Matt.
>-----Original Message-----
>From: Raffaele Bruno [mailto:raffaele.bruno@guest.cnuce.cnr.it]
>Sent: Monday, 27 May 2002 4:45 PM
>To: tcptrace@masaka.cs.ohiou.edu
>Subject: Re: [tcptrace] Hardware duplicate?
>
>
>
>Matt Muggeridge wrote:
>
>> This occurs when tcptrace sees exactly the same packet more
>than once.
>>
>> My configuration was using a switched LAN, which normally
>bridges each port.
>> So to run an indpendent sniffer requires port mirroring.
>
>Thank you Matt for your answer. Now it is clear when a
>hardware duplicate
>happens, but its not clear to me why it happens in my tests.
>
>I am not considering a switched LAN, but a Wireless LAN
>operating in the ad hoc
>mode. In my network there are 4 nodes, say A, B, C, D. I
>establish one TCP
>connection between A and B and a second TCP connection between
>C and D. Via
>tcpdump (without filtering anything) I capture all the TCP
>packets that arrives
>to the network interface of each nodes.
>
>In this configuration I have not mirroring, hence the reason
>why I receive two
>identical packets is very confusing. Have you any idea?
>
>Raffaele
>
>---------------------------------------------------------------
>-------------
>To unsubscribe, send a message with body containing
>"unsubscribe tcptrace" to
>majordomo@tcptrace.org.
>
----------------------------------------------------------------------------
To unsubscribe, send a message with body containing "unsubscribe tcptrace" to
majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 05/27/02 EDT