This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am analyzing traffic on a server that has two ethernet adapters and each adapter is attached to a different network. When I analyze one adapter or the other I do not receive a lot of bad TCP packets. When I analyze both adapters at the same time, I receive many bad TCP packets. Is there a reason why that happens?

asked 12 Nov '14, 12:05

drvenom14's gravatar image

drvenom14
11112
accept rate: 0%


When I analyze both adapters at the same time, I receive many bad TCP packets. Is there a reason why that happens?

That's probably because you write packets for the same TCP sessions, captured on both adapters (maybe adapter teaming), into the same capture file. As the order of the frames will be different from what Wireshark believes to be a correct TCP stream (seeing SEQ numbers before others, etc.), it might flags those frames.

However that's just speculation. As you did not provide the capture I can only guess. So, please upload the capture file somewhere (google drive, dropbox, cloudshark.org) and post the link here. Please also add some details why the server has two interfaces (adapter teaming yes/no), if both adapters have an IP address of the same subnet (a lot of windows admins are doing this for good or bad reasons), etc., etc.

Regards
Kurt

permanent link

answered 13 Nov '14, 13:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×87
×52
×1

question asked: 12 Nov '14, 12:05

question was seen: 1,317 times

last updated: 13 Nov '14, 13:03

p​o​w​e​r​e​d by O​S​Q​A