<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Duplicate Outgoing Packets</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2627" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Quinton,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>This can happen when running a software VPN product
like Checkpoint's Secure Remote. In fact newer versions of Secure Remote
eliminate packets rather than duplicate them (that's really bad!). If
you're running any kind of network filter or driver that operates at a low
level, it may be affecting Winpcap's packet capturing mechanism.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>DC</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=quintont@deltacompsys.com
href="mailto:quintont@deltacompsys.com">Quinton Tormanen</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, June 03, 2005 11:19
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Duplicate
Outgoing Packets</DIV>
<DIV><FONT face=Arial size=2></FONT><FONT face=Arial size=2></FONT><BR></DIV><!-- Converted from text/rtf format -->
<P><FONT face=Arial size=2>This is related to my last question, which was
answered VERY well, thank you all!</FONT> </P>
<P><FONT face=Arial size=2>I am consistently seeing duplicate packets several
microseconds apart. These are always packets being sent by my PC (the
one running winPcap). So, I have traffic between the PC and our own
device in development. It is a client/server protocol. The PC
sends a request, and our device sends a response. However, what I'm
seeing is that the PC sends two packets, which is 100% identical (including
the IP identification field, and TCP sequence numbers). I highly doubt
that both are really making it onto the wire, in the same way that the bogus
TCP checksums apparently never made it on the wire.</FONT></P>
<P><FONT face=Arial size=2>Has anyone seen this? Does anyone have a
theory for why it happens?</FONT> </P>
<P><FONT face=Arial size=2>I'm using Windows 2000 with a 3Com on-board
NIC.</FONT> </P>
<P><FONT face=Arial size=2>Quinton Tormanen</FONT> <BR><FONT face=Arial
size=2>Software Engineer</FONT> <BR><FONT face=Arial size=2>Delta Computer
Systems, Inc.</FONT> <BR><A href="http://www.deltacompsys.com"><U><FONT
face=Arial color=#0000ff size=2>http://www.deltacompsys.com</FONT></U></A>
</P>
<P></P><FONT face=Arial size=2></FONT><FONT face=Arial size=2></FONT>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>