<html>
<P>Hi, and thanks for your reply.</P>
<P>I tested today on another machines, and saw the same malfunction.</P>
<P>My Toshiba Laptop runs Windows Vista Business English, SP1. WinPcap 4.0.2 installed when installed Wireshark (I updated Wireshark yesterday, but the problem have been happening time ago, but I didn't realized the problem until now). NIC = RTL8101.</P>
<P>Today, I installed the latest Wireshark on 6 IBM PC's, and found the same replicating issue when sniffing (with Wireshark) on them (copy of the packet received, but with their own MAC instead of the original one). The IBM PC's are running either Windows NT 2000 spanish or XP Professional (if you need the exact info I can go back and check) . </P>
<P>The NPF service used for sniffing without administrator privileges isn't activated.</P>
<P>Ideas?</P>
<P>(If you think it can help, I can try with ubuntu 8.04 LiveDVD, but since I'm not a linux guy I would need some guidance on the package and how to running it.)<BR>
<BR>
<BR>
<BR>
<B>On Mie Oct 29 14:33 , "Gianluca Varenni" <GIANLUCA.VARENNI@CACETECH.COM>sent:<BR>
<BR>
</P></B>
<BLOCKQUOTE style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #f5f5f5 2px solid; MARGIN-RIGHT: 0px"><DEFANGED_META content="text/html; charset=iso-8859-1" http-equiv="Content-Type"><DEFANGED_META content="MSHTML 6.00.6000.16735" name="GENERATOR">
<DEFANGED_BODY bgColor="#ffffff">
<DIV><FONT size=2>I have no idea. It looks like a bug in the NIC or in its driver (WinPcap does not replicate such packets). Are you using the latest available driver for this NIC?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV<BR>
</FONT></DIV>
<BLOCKQUOTE style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B> <A title=chavezf@tutopia.com href="javascript:top.opencompose('chavezf@tutopia.com','','','')">Feliciano Chavez</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org href="javascript:top.opencompose('winpcap-users@winpcap.org','','','')">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, October 29, 2008 4:07 AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] My NIC is redirecting/replicating packets whensniffing</DIV>
<DIV><BR>
</DIV>
<P>Hello,</P>
<P>I found that my NIC redirects (or replicates) some traffic when in promiscuous mode. I mean, it sends some packets back to the network: The same packet, except for sending its own MAC address instead of the original one. Found it happens most with SIP, ARP, ICMP, I haven't discarded if it happens with another protocols as well.</P>
<P>My machine runs Windows Vista Bussiness, my NIC is RTL8101.</P>
<P>The problem happens with Wireshark, but also with WinDump.</P>
<P>Suggestions?</P><BR>
<P>
<HR>
<P></P>_______________________________________________<BR>
Winpcap-users mailing list<BR>
Winpcap-users@winpcap.org<BR>
https://www.winpcap.org/mailman/listinfo/winpcap-users<BR>
</BLOCKQUOTE></BLOCKQUOTE>
</html><BR>