Why packets injected with libpcap are duplicated?
- by r0u1i
I'm using sharppcap in order to send packets as part of a monitoring system. Usually it works well but I've encountered the strangest bug on a hosted vista machine and I would like your help.
On that virtual vista machine, injected packets are duplicated. That is, if I send a ping request using libpcap, it somehow gets duplicated and I get two requests on the destination machine. The two requests are almost identical byte-wise, and the only difference between them is that the second packet's TTL field is one minus the original packet's value.
Using wireshark I can see the packet gets duplicated before it (and its clone) leave the vista machine.
The problem is manifested even when using other tools for injecting packets using libpcap (namely PlayCap).
Any ideas?