<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle">P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</style>
</head>
<body ocsi="0" fPStyle="1">
<div style="FONT-FAMILY: Tahoma; DIRECTION: ltr; COLOR: #000000; FONT-SIZE: 10pt">
<div>
<p>I'm running Win XP 64 and I do have a VPN Client (NCP) installed (thought not on right now).</p>
<p>windump version 3.9.5</p>
<p>winpcap version 4.1.2</p>
<p> </p>
<p>I'm seeing double outgoing packets like this when running windump on this machine.</p>
<p>048261 IP 192.168.1.103.2906 > 74.125.225.82.443: . ack 514 win 65016 <nop,nop,timestamp 273888 1857597007><br>
000027 IP 192.168.1.103.2906 > 74.125.225.82.443: . ack 514 win 65016 <nop,nop,timestamp 273888 1857597007><br>
100523 IP 192.168.1.103.2919 > 74.125.225.82.443: . ack 545 win 65069 <nop,nop,timestamp 273889 1857597112><br>
000018 IP 192.168.1.103.2919 > 74.125.225.82.443: . ack 545 win 65069 <nop,nop,timestamp 273889 1857597112></p>
<p> </p>
<p>Has anybody else seen something like this? They don't appear to be actually leaving in duplicate form. If I ping a place I'll see 2X packets go out but only 1X packets returned. Like this:</p>
<p>windump -n -ttt -i 2 host 72.14.204.103<br>
windump: listening on \Device\NPF_{8F0B5622-AE23-4219-ACBE-6DC2FC129CC2}<br>
000000 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 10240, length 40<br>
000028 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 10240, length 40<br>
043099 IP 72.14.204.103 > 192.168.1.103: ICMP echo reply, id 768, seq 10240, length 40<br>
956474 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 10496, length 40<br>
000042 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 10496, length 40<br>
042644 IP 72.14.204.103 > 192.168.1.103: ICMP echo reply, id 768, seq 10496, length 40<br>
958303 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 10752, length 40<br>
000030 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 10752, length 40<br>
041623 IP 72.14.204.103 > 192.168.1.103: ICMP echo reply, id 768, seq 10752, length 40<br>
960278 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 11008, length 40<br>
000025 IP 192.168.1.103 > 72.14.204.103: ICMP echo request, id 768, seq 11008, length 40<br>
042326 IP 72.14.204.103 > 192.168.1.103: ICMP echo reply, id 768, seq 11008, length 40</p>
<p>12 packets captured</p>
<p> </p>
<p> </p>
<p> </p>
<div style="FONT-FAMILY: Tahoma; FONT-SIZE: 13px">
<p>Michael D. Black</p>
<p>Senior Scientist</p>
<p>Advanced Analytics Directorate</p>
<p>Advanced GEOINT Solutions Operating Unit</p>
<p>Northrop Grumman Information Systems</p>
</div>
</div>
</div>
</body>
</html>