Snort users asked if snort-users had a problem with duplicate packets. A number of switches have had to be set up in such a way that you can end up seeing each packet TWICE on the snort interface. I’ve been told by our network engineers that this has to be the case in order for the IDS to see the networks it needs to on one card. If the decision is made to copy in and out of the SPAN port, duplicate packets will appear when intra-switch traffic is carried.”]
Source: https://taosecurity.blogspot.com/2005/11/why-duplicate-packets-may-appear-on.html