Ask Your Question

Does wireshark hide packets?

asked 2021-08-06 13:50:49 +0000

Hello team,

with ERSPAN [one ERSPAN session], if the packet is captured twice on the same switch, ingress and egress, I trust both should be sent to the ERSPAN destination [which is windows with wireshark].

I see the packet only one time, could it be the wireshark is hiding packet to avoid duplicate? is there a way to show it?

edit retag flag offensive close merge delete


source intf,rx?tx? both?

7ACE gravatar image7ACE ( 2021-08-06 14:10:09 +0000 )edit

2 Answers

Sort by » oldest newest most voted

answered 2021-08-06 20:11:33 +0000

BigFatCat gravatar image

If there is only one ingress mirror and one egress mirror then there should be only one packet, e.g. ingress would be only traffic from the local computer and egress would be only traffic from the WAN. A 1G full-duplex port has the capacity of simultaneous of 1G ingress traffic and 1G egress traffic. There is the possibility that the mirrored ingress and egress traffic could exceed the monitoring port.

edit flag offensive delete link more

answered 2021-08-06 15:07:43 +0000

hugo.vanderkooij gravatar image

Unless you have used a filter you should see all packets.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2021-08-06 13:50:49 +0000

Seen: 185 times

Last updated: Aug 06 '21