6333d9d7   
   From: grahn+nntp@snipabacken.se   
      
   On Mon, 2010-06-07, auxvivrespos wrote:   
   > I've recently been teaching myself about tcp/ip by exploring the   
   > traffic flowing across my computer's network interface.  I started by   
   > using tcpdump to view network traffic but found it difficult to read   
   > the output.   
      
   Sometimes it's easier than Wireshark though -- if you're already   
   familiar with the protocol and with tcpdump.   
      
   > I switched to Wireshark and was overwhelmed by the amount   
   > traffic I had to sift through.   
   >   
   > To ease into things, I began by looking at only traffic related to IRC   
   > (internet relay chat).  I've observed that upwards of 50% of the   
   > packets are being flagged as "bad" by Wireshark.  These packets are   
   > duplicate ACK's and out-of-order packets.  It seems that ACK packets   
   > coming from the IRC are being repeated.  I'm not sure why this could   
   > be.  Inbound IRC packets also appear to be sent twice, with the second   
   > packet being labelled as out-of-order.   
      
   I haven't looked at your example data, but is perhaps Wireshark seeing   
   every packet twice? That can happen, I think, if you've instructed   
   Wireshark to snoop the "wrong" interface, and maybe you have some kind   
   of tunnelling so your traffic is seen twice: with tunneling headers on   
   the physical interface, and without them on the tunneled   
   pseudo-interface?   
      
   If that is the case, you'll be able to tell from the timestamps.   
      
   /Jorgen   
      
   --   
     // Jorgen Grahn    O  o   .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)