<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<STYLE type=text/css>DIV {
MARGIN: 0px
}
</STYLE>
<META content="MSHTML 6.00.6000.16640" name=GENERATOR></HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>Absolutely no idea. And the fact that it happens on linux with
libpcap is pretty weird. Both the windows machine and the linux one are Vmware
guests, i suppose. Right? If so, are you using the original linux/windows
drivers for the virtual nic on the guest, or the one provided by
vmware?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=michaeld3000@yahoo.com href="mailto:michaeld3000@yahoo.com">Michael
Domberg</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, April 16, 2008 11:44
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] RARP Storm upon
starting winpcap</DIV>
<DIV><BR></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV>Hi,<BR>I am using Microsoft Windows Server 2003 with winpcap 4.0.2 on
VMWare ESX 3. Everytime I start a capture (with Windump or Wireshark 1.0.0)
winpcap sends a couple of RARP requests. It seems like my host is trying to
resolve its own MAC-address. The amount of requests changes from time to time.
Sometimes only 3 requests are generated, sometimes up to 500. Even if I stop
capturing some RARP packets are sent over the network. The capturing host
can't see its own RARP requests, all other host in the same subnet receive all
packets. If two or more hosts within the local network use winpcap these
requests block all other traffic. This even occurs with libpcap on linux if
the linux host is in the same network.<BR>All searches in the mailing list,
google groups and google were to no avail.<BR><BR>Any
suggestions?<BR><BR>Michael.<BR></DIV></DIV><BR>
<HR SIZE=1>
Be a better friend, newshound, and know-it-all with Yahoo! Mobile. <A
href="http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ ">Try
it now.</A>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>