Ask Your Question

editcap -d not removing duplicate packets with the same IP ID. Any reason why?

asked 2018-08-08 18:52:15 +0000

ccara924 gravatar image

updated 2018-08-08 19:01:42 +0000

I have a capture with mutiple duplicate packets. For instance, I have multiple instances of SYNs with the same IP IDs. The editcap -d command is not removing any of the packets. Does anyone know why this would occur?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-08-08 19:28:26 +0000

Jim Aragon gravatar image

Editcap does not determine that packets are duplicates based on the IP ID. It uses a hash of the packet. So if two packets are between the same IP addresses and both have the same IP ID, but something else--something other than the IP ID--is different, editcap will not see them as duplicates.

Also, editcap only looks within the duplicate window, which by default is 5, meaning the current packet and the previous four packets. So if packet 10 is a duplicate of packet 2, editcap won't see that because packet 2 is not within the four previous packets from packet 10. You can change the size of the duplicate window. You can also change it to be based on time rather than number of packets.

Enter "editcap -h" to see all the options.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-08-08 18:52:15 +0000

Seen: 878 times

Last updated: Aug 08 '18