Wireshark · Wireshark-users: [Wireshark-users] Capturing on Linux interface any

["Abhik Sarkar" <sarkar.abhik@xxxxxxxxx>]

Hello All,

I have noticed that when a capture is performed on a Linux host on
interface 'any' and that system has bonded interfaces, there are a lot
of TCP duplicates and out-of-order packets reported. It seems it is
because the packets are captured twice... once from the bondX
interface and one from the physical interface. However, this seems to
happen only for outgoing packets. For incoming packets, I assume they
are captured only on the physical interface. Can someone point me to a
source where I might find an explanation of this behaviour?

Thanks,
Abhik.