This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Folks,

My home network is set up as MODEM <--> WAP (WRT54GL) <--> 16 port switch (GS116E). I have a 2nd NIC in my monitor computer connected to a port on the GS116E set up to mirror the computer ports. I do not mirror the NAS or uplink ports. Then I tee at the router which sends a copy of any traffic handled by the access point (iptables -A POSTROUTING -t mangle -j ROUTE --gw 10.0.0.199 --tee). So far so good.

By not mirroring the uplink or NAS ports on the switch I don't get extra packets when file transfers occur, nor from traffic bound for the WAN or the WLAN. The one trouble I have left is that any traffic to/from the WAN from a computer on the switch get doubled (one copy from the tee and one from the port mirror).

Are there any suggestions how I might eliminate the duplicates? Maybe some set of commands at the WAP (WRT54GL running Tomato)?

I could look for a cheap NAT device to go between the modem and the switch and move the WAP onto the switch I guess, but I was looking for a "no added device" solution.

THANKS!

ron <><

asked 19 Jan '12, 19:38

KK1L's gravatar image

KK1L
1224
accept rate: 0%


You could capture the traffic with duplicates, and then remove them from the trace file afterwards, using editpcap -d. I just answered a similar question here, so you might want to look at that one, too.

Since I already saw in another post that you're having problems with the MAC addresses in the "duplicate" packets being different (while the rest stays the same) I have to add that editcap -d might not work as expected, though. editcap looks for exact duplicates by calculating MD5 hashs on frames, and if the MAC is different, so is the hash. Which will lead to "duplicates" still remaining in the "cleaned" trace file since the hashs didn't match with the original packets.

A possible workaround could be to do the cleanup process in a two step way:

  1. capture the data, including duplicates
  2. replace the monitor NIC MAC with the original MAC, for example by using a packet editor like bittwiste. This could be a very complicated process, since you'll probably have to replace the same monitor NIC MAC with different other, original MACs (of the computer and the router). That could require you to split the trace into separate files for each node first, and I just feel a headache coming up :-)
  3. Deduplicate the resulting file with editcap -d

Other than that, you're probably out of luck, since removing duplicates expects them to be 100% the same, bit by bit.

permanent link

answered 20 Jan '12, 04:07

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×205
×41
×33
×8

question asked: 19 Jan '12, 19:38

question was seen: 7,232 times

last updated: 20 Jan '12, 04:07

p​o​w​e​r​e​d by O​S​Q​A