With the ExtraHop L3 Dedup Enabled and I capture traffic on both sides of a switch, I know duplicate packets should be filtered out. But how should ExtraHop dedupe handle this scenario when I change the VLAN ID on the packets?
I created the following test scenario to try this out.
I could see the traffic as 25.9Mb/s at the each VLAN, But the traffic on device is 51.8Mb/s
It looks like the traffic on Device is is not being deduped for the raw packet rate.
Is the ExtraHop Dedupe feature designed to dedupe this traffic when switching VLAN IDs and sending all the traffic to the ExtraHop? What about if I send the traffic to more than one ExtraHop Capture interface?