<div dir="ltr"><div dir="ltr">On Fri, Oct 4, 2019 at 4:08 AM Palumbo Mauro <<a href="mailto:mauro.palumbo@aizoon.it">mauro.palumbo@aizoon.it</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="IT">
<div class="gmail-m_2243767711744837270WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi Justin,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> I am in fact seeing 2,2 or 2,0 as orig_pkts and resp_pkts. And I confirmed this with tcpdump. So I believe it is an
issue with the network we are tapping as I see these duplicated packets only for dns.</span></p></div></div></blockquote><div><br></div><div>Possibly, but you may have duplicates everywhere. The tcp reassembler can use the sequence numbers to avoid analyzing the same traffic twice, but UDP doesn't have anything like that. DNS is just the place you tend to notice the duplicate traffic the most.</div></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Justin</div></div></div>