 | 1 | initial version |
It could be the way you are obtaining your capture. For instance, if you are using port span (port mirror), you could be getting the TX/RX of both the host and the upstream network port.
Look at the ip.id field and compare packet 1 and 2. If they are the same, then Wireshark is being given a duplicate copy of the frame (not a retransmit by your host) possibly due to the configuration of your port span.
It could be due to other circumstances, but sharing a pcap trace would greatly improve the community's chances of assisting you with your question.
