Does wireshark hide packets?

asked 2021-08-06 13:50:49 +0000

Hello team,

with ERSPAN [one ERSPAN session], if the packet is captured twice on the same switch, ingress and egress, I trust both should be sent to the ERSPAN destination [which is windows with wireshark].

I see the packet only one time, could it be the wireshark is hiding packet to avoid duplicate? is there a way to show it?

edit retag flag offensive close merge delete

Comments

source intf，rx？tx? both?

7ACE ( 2021-08-06 14:10:09 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2021-08-06 20:11:33 +0000

BigFatCat
31 ●2 ●88 ●4

If there is only one ingress mirror and one egress mirror then there should be only one packet, e.g. ingress would be only traffic from the local computer and egress would be only traffic from the WAN. A 1G full-duplex port has the capacity of simultaneous of 1G ingress traffic and 1G egress traffic. There is the possibility that the mirrored ingress and egress traffic could exceed the monitoring port.