Viavi Apex Enterprise G3-APEX-ENT-32T, User Manual

Page: 350 / 380

Understanding duplicate packets
350 GigaStor (23 Feb 2018) — Archive/Non-authoritative version
Deduplication details for the capture card
The packet deduplication engine of the capture card is controlled by features in
Observer. The features must be in use for packet deduplication to work.
For capture card packet deduplication to work:
♦
Hardware acceleration must be enabled and in use.
♦
Virtual adapters must enabled and in use.
These settings can be used to ignore certain packet headers when determining if
a packet is a duplicate:
IP time to live (TTL) If selected, the time to live (TTL) value in packets would not be
examined when determining if a packet is a duplicate. This is
useful to select when the same packets makes multiple hops
through routers.
TCP sequence and
acknowledgement
numbers, and TCP
options
If selected, TCP sequence and acknowledgement numbers,
and also TCP options, are not would not be examined when
determining if a packet is a duplicate. Overall, this ignores the
ordering of the packets and the values of optional packet fields.
How to remove duplicate packets from saved captures
Duplicate packets are packets that are captured twice or multiple times by
Observer. Typically, duplicates are a result of how data is sent to Observer .
For a switch, the use of a SPAN/mirror port and/or trunk is required to capture
data. Knowing this, the following scenarios may produce duplicate packets—
which are then seen by Observer:
♦
If a SPAN/mirror port is configured to send both ingress (in) and egress
(out) data from multiple ports, any communication between any two ports
being monitored results in a duplicate packet.
♦
If a trunk is monitoring multiple VLANS, data flowing between VLANS is
seen as duplicate packets.
♦
If Observer is monitoring data pre- and post-route. Meaning, a single
packet is seen at one location pre-route and again post-route. The post-
route packet is considered by Observer as a duplicate packet.
While this is harmless as it pertains to your network working correctly, Observer
identifies these as duplicate packets. There are two ways of dealing with this
situation:
♦
Configure the SPAN/mirror port or trunk to show only ingress or egress
traffic, but not both .
♦
Use Observer to remove duplicate packets from an existing capture file.
Observer includes a feature that removes the “noise” caused by duplicate packets
without affecting the underlying packet capture data. This feature is a special
version of the standard capture buffer file-loader. To remove duplicate packets
(i.e. skip them) while loading a capture buffer file, complete the following steps:
2. Type, or navigate to, the capture file you want to load.
3. Select your criteria for how duplicate packets are handled.
Skip duplicate
packets only
During evaluation, packets are only compared against packets
that arrived at nearly the same time, or specifically during