<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16735" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>I have no idea. It looks like a bug in the NIC or in its
driver (WinPcap does not replicate such packets). Are you using the latest
available driver for this NIC?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV<BR></FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=chavezf@tutopia.com href="mailto:chavezf@tutopia.com">Feliciano
Chavez</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, October 29, 2008 4:07
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] My NIC is
redirecting/replicating packets whensniffing</DIV>
<DIV><BR></DIV>
<P>Hello,</P>
<P>I found that my NIC redirects (or replicates) some traffic when in
promiscuous mode. I mean, it sends some packets back to the network: The same
packet, except for sending its own MAC address instead of the
original one. Found it happens most with SIP, ARP, ICMP, I haven't discarded
if it happens with another protocols as well.</P>
<P>My machine runs Windows Vista Bussiness, my NIC is RTL8101.</P>
<P>The problem happens with Wireshark, but also with WinDump.</P>
<P>Suggestions?</P><BR>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>