Hi,

Can anyone explain why do I see same request twice in tcpdump package when I use "tcpdump -i any"?

So I'm tracing packets on eth1.800 interface, but using "tcpdump -i any" to capture them. What I see is that the requests/responses from my side seem to appear as duplicate in the pcap file, but the incoming requests/responses are just single packets.

If I do "tcpdump -i eth1.800", both outgoing and incoming requests/responses are single packets.

I tried to google this and found some similar posts, but there was no explanation why this happens.

Thanks!

Perhaps it is tracing that you wrote to the NIC, then the nic sees its own data on the half duplex ethernet? Is there an option for half duplex ethernet? Maybe -p if you are not that nosy? http://www.unix.com/man-page/all/1/tcpdump/