Wireshark-users: Re: [Wireshark-users] Trouble with SSL dissector - got ithalf working!
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Wed, 30 Sep 2009 17:54:29 -0700
At 08:40 AM 9/30/2009, Sake Blok wrote:
Duplicate packets will be displayed as "ouf-of-order" at the tcp level, as there is no code (yet) to recognize these packets as duplicates. I bet you are capturing traffic to and from a VM on the host on which this VM runs. In VMware, this results in duplicates (I have no idea why, anyone?).

My Windows 2008 Server running in VMWare Server 2 duplicates most outbound packets.  One is sent with the MAC address of the host and the other with the MAC address of the VM.  This causes some problems with my firewall, but I have never been able to figure out why it happens.  I found one post about this but there was no explanation or resolution.