Scenario 1: Receiving Network Traffic From Multiple Routers; Scenario 2: Receiving Network Traffic From Multiple Vlans - Network Instruments Matrix User Manual

Duplicate packets reduce statistical accuracy, which leads to higher preceived levels of traffic or network
connections.
In some cases you may want to retain the duplicate packets, such as when packets are being looped or when
multiple VLANs are used with your Matrix. Retaining a copy of duplicate packets and their traversal through both
VLANs may be necessary when verifying whether the traffic was routed properly.
If you experience duplicate packets, consider your analytical needs and network topology when deciding
whether deduplication should be used.

Scenario 1: Receiving network traffic from multiple routers

Cause of duplicates: Some packets are traversing multiple routers and those routers are copying their traffic to
the SPAN/mirror port. When this occurs it causes duplicate packets in the Matrix.
Non-duplicate fields: Not only is each router decrementing the TTL field in the IP header, but it is also
modifying the MAC address.
Solution: Ignore the MAC address pair and TTL fields.

Scenario 2: Receiving network traffic from multiple VLANs

Cause of duplicates: Some packets are traversing some of your VLANs. If the SPAN/mirror port is configured to
copy packets traversing each VLAN, any packets that travel through multiple VLANs are duplicated.
Non-duplicate fields: In the Ethernet header, the Ethertype field may change if the packet is not encapsulated
with a VLAN header when the packet is copied. If both packets contain a VLAN encapsulation header, then the
VLAN values will differ. It is possible the TTL field may also differ, and in some situations, the MAC address pair
may have changed.
Solution: Ignore the Ethertype and VLAN/MPLS fields, and it may also be necessary to ignore the TTL and the
MAC address pair fields.
42 | Matrix™ (pub. 25.Apr.2014)