Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

With your current capture setup you are capturing data from multiple vlans concurrently. Some of the tcp sessions are captured twice because the two peer hosts are on different vlans. Capturing the same packet on both vlans will confuse the TCP analysis.

In the capture file Forestry_MX_LAN.pcap, the display filter shows packets from ip.addr== && ip.addr== The session appears to have lots of retransmissions. But if you look more closely you will see that the packets are actually captured twice, once on and the other on

If you apply a display filter for and then use the main menu option Edit -> Ignore All Displayed then all the displayed packets will disappear. Now update the display filter to just you will see just the copies of the without all of the duplicates. You can restore the ignored packets by reloading the capture file.

Regarding your capture file Forestry_MX_LAN_1182023.pcap it shows evidence of massive packet loss likely due to the capture setup. In both capture files you have captured Spanning Tree Protocol (STP) packets. These are normally sent at 2 second intervals. In the Forestry_MX_LAN.pcap with a display filter of stp we can see STP packets at regular 2 second intervals, but in the Forestry_MX_LAN_1182023.pcap file we see irregular gaps between between the STP packets. With any sort of packet capture one has to consider the possibility that the capture file itself could be missing packets that were in fact sent but simply were not captured because of the capture setup itself.