Re: [Ethereal-users] Ethereal displaying packets twice

[Guy Harris <guy@xxxxxxxxxx>]

> Are you sniffing on the loopback interface? If so, this is a known
> behaviour of Linux loopback with libpcap... it sees the packet both
> coming and going.

...unless you download, build, and install the latest CVS snapshot of
libpcap from tcpdump.org (not 0.5.2, but the nightly snapshot).  That
version, on Linux 2.2 and later kernels, will discard one of the two
copies of packets delivered to loopback interfaces, so you see only one
copy.

Note, though, that the tcpdump.org versions don't build shared
libraries, and if you install those versions, there's no guarantee that
if you then try to build Ethereal it'll actually build with the version
you install (unless you configure with "--prefix=/usr" and, after you
install, get rid of the libpcap shared library - but getting rid of the
shared library will probably break other programs).

The downside of OSes coming bundled with libpcap - you have trouble
replacing the bundled version with other versions....