Why packets injected with libpcap are duplicated?

Posted by r0u1i on Stack Overflow See other posts from Stack Overflow or by r0u1i
Published on 2010-05-13T11:25:23Z Indexed on 2010/05/14 3:34 UTC
Read the original article Hit count: 332

Filed under:

sharppcap

|

libpcap

|

networking

I'm using sharppcap in order to send packets as part of a monitoring system. Usually it works well but I've encountered the strangest bug on a hosted vista machine and I would like your help.

On that virtual vista machine, injected packets are duplicated. That is, if I send a ping request using libpcap, it somehow gets duplicated and I get two requests on the destination machine. The two requests are almost identical byte-wise, and the only difference between them is that the second packet's TTL field is one minus the original packet's value.

Using wireshark I can see the packet gets duplicated before it (and its clone) leave the vista machine. The problem is manifested even when using other tools for injecting packets using libpcap (namely PlayCap).

Any ideas?

© Stack Overflow or respective owner

Related posts about sharppcap

SharpPcap issue

as seen on Stack Overflow - Search for 'Stack Overflow'
This is my first time to use SharpPcap library. I created new project with VC# 2008 and I added SharpPcap as a reference to my project. I post a sample code to get interface of my pc but I'm getting this error: Error 1 The type or namespace name 'PcapDeviceList' could not be found (are you… >>> More
Interpreting the Packets using sharppcap

as seen on Stack Overflow - Search for 'Stack Overflow'
Is it possible to interpret every coming packets using sharppcap? >>> More
SharpPcap - A Packet Capture retring seding messesge problem.

as seen on Stack Overflow - Search for 'Stack Overflow'
I trying to capture packets using SharpPcap library. I'm able to return the packets details but I'm having problem to get what the message content inside the packet. the packet using .Data to return the message and when I use it it is returning (System.Byte[]). here is the library website: http://www… >>> More
SharpPcap - A Packet Capture getting messesge problem.

as seen on Stack Overflow - Search for 'Stack Overflow'
I trying to capture packets using SharpPcap library. I'm able to return the packets details but I'm having problem to get what the message content inside the packet. the packet using .Data to return the message and when I use it it is returning (System.Byte[]). here is the library website: http://www… >>> More
How do I determine if a packet is RTP/RTCP?

as seen on Stack Overflow - Search for 'Stack Overflow'
I am using SharpPCap which is built on WinPCap to capture UDP traffic. My end goal is to capture the audio data from H.323 and save those phone conversations as WAV files. But first thing is first - I need to figure out what my UDP packets are crossing the NIC. SharpPCap provides a UdpPacket class… >>> More

Related posts about libpcap

Does libpcap get a copy of the packet ?

as seen on Stack Overflow - Search for 'Stack Overflow'
Does libpcap get a copy of the packet or the actual packet? By copy, I mean: the application using libpcap gets packet A, and the kernel also gets packet A. By actual, I mean: only the application using libpcap gets packet A, but the kernel didn't get it. >>> More
LIBPCAP and WIRESHARK Capture on PPP

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I have written a small bridge program using LIBPCAP API. I have installed Winpcap 3.1 Beta for support in order to capture from a PPP interface. What i do is, I capture from the PPP interface through my LIBPCAP program and send the traffic to another Ethernet interface in my computer. Then i… >>> More
libpcap IP Packet Reassembly

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I'm looking for a sample code for IP packet reassembly in C with libpcap*. Is IP packet defragmentation implemented in libpcap library officially? I've found this proposal : http://www.mail-archive.com/[email protected]/msg02991.html[this][1] . Are there any implementation… >>> More
Why packets injected with libpcap are duplicated?

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using sharppcap in order to send packets as part of a monitoring system. Usually it works well but I've encountered the strangest bug on a hosted vista machine and I would like your help. On that virtual vista machine, injected packets are duplicated. That is, if I send a ping request using libpcap… >>> More
libpcap packet size

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm working with libpcap in C on linux (centos) and I'm following this guide I want to simply print out the entire packet in ascii and i'v managed to get it working by casting it a u_char* in the "my_callback" function. But I can't figure out how to get the length of the data. strstr didn't work.… >>> More