Hello, I am sending a PING between one two computers. I am finding that Wireshark is detecting duplicate frames of each ping request and reply. I notice each of the duplicates has a different source value e.g. one is: Source: Cisco4f:b1:05 (00:21:a0:4f:b1:05) the other is: Source: DigitalD99:0a:3d (00:11:6b:99:0a:3d) Is this because of multiple interfaces on my routers, or is it some other reason ? Any help would be appreciated. asked 19 Sep '12, 01:18  fran1942 |
One Answer:
I think you're seeing the same packet twice: before and after it has been routed. You can tell by looking at the TTL value in the IP header - it should be one lower in the duplicate than in the original. You can use the TTL to filter on only the origial packets if you want to. answered 19 Sep '12, 01:24  Jasper ♦♦ |
