[Winpcap-users] Injected packets duplicated on Vista (was: vmware)
rouli
rouli.net at gmail.com
Sun May 16 04:20:43 PDT 2010
And on the virtual vista machine duplication only occurs when IP routing is
enabled.
here's the routing table, can someone see what is configured wrong that may
cause such a problem?
I'm inject a ping request packet whose destination address is 192.168.1.28
and send it through the interface owning 192.168.1.61
===========================================================================
Interface List
23 ...00 50 56 85 06 aa ...... Intel(R) PRO/1000 MT Network Connection #3
21 ...00 50 56 85 36 4b ...... Intel(R) PRO/1000 MT Network Connection #2
19 ...00 50 56 85 5b 12 ...... Intel(R) PRO/1000 MT Network Connection
1 ........................... Software Loopback Interface 1
26 ...00 00 00 00 00 00 00 e0
isatap.{EB4B88C1-BB53-44F4-93B1-4136C7DB6851}
25 ...00 00 00 00 00 00 00 e0
isatap.{FDB3ED54-237A-4F75-801A-376BA00E0C25}
27 ...00 00 00 00 00 00 00 e0 isatap.engulfix.net
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.61 11
192.168.1.61 255.255.255.255 On-link 192.168.1.61 266
192.168.1.76 255.255.255.255 On-link 192.168.1.76 266
192.168.1.77 255.255.255.255 On-link 192.168.1.77 266
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
1 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
On Sun, May 16, 2010 at 11:20 AM, rouli <rouli.net at gmail.com> wrote:
> Ok, I've fixed the problem on the physical machine, though I'm not sure
> what made it go away, and I still have it on the virtual machine.
> On the physical machine there are three network cards, only one was
> actually connected to the network - the other two were unplugged. Moreover,
> the two unplugged cards had a static ip address configured which didn't
> match our network mask. Once I set those two cards to obtain a dynamic
> address, the duplication has stopped (weird, huh?). I've since tried to
> recreate the problem, but failed to do so; And as I've mentioned, I still
> got it on the virtual machine whose image was taken from the physical
> machine, even though on it all network cards are configured properly.
>
>
>
> On Thu, May 13, 2010 at 6:45 PM, Gianluca Varenni <
> gianluca.varenni at cacetech.com> wrote:
>
>> Packet duplication is usually caused by the virtual NIC drivers of
>> vmware (or in any case their networking virtualization layer). I've seen
>> this kind of problems with vmware workstation, but I've never used vCenter
>> (which I believe is just a management tool for a cloud of VMs using VMware
>> server or something similar).
>>
>> Have a nice day
>> GV
>>
>> *From:* rouli <rouli.net at gmail.com>
>> *Sent:* Thursday, May 13, 2010 8:31 AM
>> *To:* Gianluca Varenni <gianluca.varenni at cacetech.com>
>> *Cc:* winpcap-users <winpcap-users at winpcap.org>
>> *Subject:* Re: [Winpcap-users] Injected packets are duplicated on vmware
>>
>> vCenter 4.0.0
>> After some digging, I don't believe the problem is with the VMWare, but
>> rather with vista.
>> I have installed the same vista image on a physical machine, and still see
>> packet duplication.
>>
>> Since it's only got Service Pack 1 installed, I'm now installing Service
>> Pack 2 and will check whether the problem persists.
>>
>>
>>
>>
>>
>> On Thu, May 13, 2010 at 5:59 PM, Gianluca Varenni <
>> gianluca.varenni at cacetech.com> wrote:
>>
>>> Which version of vmware are you using?
>>>
>>> Have a nice day
>>> GV
>>>
>>> *From:* rouli <rouli.net at gmail.com>
>>> *Sent:* Thursday, May 13, 2010 6:04 AM
>>> *To:* winpcap-users <winpcap-users at winpcap.org>
>>> *Subject:* [Winpcap-users] Injected packets are duplicated on vmware
>>>
>>> I'm trying to figure out a setup issue and would appreciate any help.
>>> I have a vista virtual machine and a program that injects packet to the
>>> network using winpcap.
>>> Every injected packet is duplicated, where the second packet is the exact
>>> copy of the original packet but only the IP's checksum and TTL are changed
>>> (TTL decreased by one).
>>> For example, if I inject an ICMP echo request using winpcap, the target
>>> machine actually gets two requests.
>>>
>>> The duplication happens on the vista machine - I've validated this by
>>> using wireshark.
>>>
>>> Any ideas of what can cause such an issue?
>>>
>>> Thanks
>>>
>>> ------------------------------
>>>
>>> _______________________________________________
>>> Winpcap-users mailing list
>>> Winpcap-users at winpcap.org
>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100516/e81586b1/attachment.htm
More information about the Winpcap-users
mailing list