Hi, is it possible to remove duplicate packets not from a pcap file, but from a stream of packets from standard output? In other words, I would like to remove duplicates on-the-fly (with of course some buffering delay). editcap doesn't seem to provide that, but I might be mistaken. Thank you in advance for the help. asked 05 Aug '14, 23:25  Al Bundy |
One Answer:
The only way to do that that I know of is to use a special capture card or "intelligent" hardware TAP (both in the price range of at least 4 digits). I haven't seen a software solution that would do this on the fly. And you're right, editcap only works on pcap files. answered 06 Aug '14, 01:28  Jasper ♦♦ |
Honestly, I can't imagine an environment where that would be necessary. Could you please add a real world use case?