Does wireshark hide packets?

ERSPAN
wiresahrk
retag add tags

Hello team,

with ERSPAN [one ERSPAN session], if the packet is captured twice on the same switch, ingress and egress, I trust both should be sent to the ERSPAN destination [which is windows with wireshark].

I see the packet only one time, could it be the wireshark is hiding packet to avoid duplicate? is there a way to show it?

Mike9962

asked 2021-08-06 13:50:49 +0000

edit flag offensive 0 remove flag close merge delete

Comments

source intf，rx？tx? both?

7ACE (2021-08-06 14:10:09 +0000) edit

add a comment see more comments

2 Answers

Sort by

oldest

newest

most voted

Unless you have used a filter you should see all packets.

hugo.vanderkooij

answered 2021-08-06 15:07:43 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

If there is only one ingress mirror and one egress mirror then there should be only one packet, e.g. ingress would be only traffic from the local computer and egress would be only traffic from the WAN. A 1G full-duplex port has the capacity of simultaneous of 1G ingress traffic and 1G egress traffic. There is the possibility that the mirrored ingress and egress traffic could exceed the monitoring port.

BigFatCat

answered 2021-08-06 20:11:33 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer

Does wireshark hide packets? edit

Comments

2 Answers

Comments

Comments