[Winpcap-users] Sending packets to own NIC

[Mark Pizzolato - Winpcap-Users]

On Sunday, September 23, 2018 at 10:20 AM, Guy Harris wrote:
> On Sep 23, 2018, at 4:37 AM, Reznicencu Sergiu
> <sergiureznicencu at gmail.com> wrote:
> 
> > I forgot to mention that I already recalculate the ip checksum. It is weird that
> I cann see in wireshark the packets that I modified and resnt. Shouldn't the
> packets be in "loopback"?
> 
> On most UN*Xes, yes; they will show up on the loopback interface (lo0 or lo).
> 
> On Windows, there isn't such an interface.  WinPcap doesn't capture that
> traffic; 

Actually, WinPcap, by default, does capture all traffic you transmit using 
pcap_sendpacket() on a pcap_t handle (unless you're filtering to exclude it).

That transmitted traffic will in fact be received by the host system's network 
Stack (presuming matching MAC and IP address values on the interface your 
pcap_t handle is connected to).

This receipt will be in addition to the fact that the host system's network
stack will also have received the original traffic which you've rewritten.

WinPcap is not a facility that will let you capture traffic and inhibit its 
reception by the host system's network stack.

- Mark Pizzolato