<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple id=MailContainerBody
name="Compose message area">
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>It can also happen if "IP Routing" is enabled.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'>C:\> <b>ipconfig -all</b><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'>Windows IP Configuration<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Host Name . . . . . . . . . . . . :
censored<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Primary Dns Suffix . . . . . .
. :<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Node Type . . . . . . . . . . . . :
Unknown<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> </span><b><span style='font-size:
9.0pt;font-family:"Lucida Console"'>IP Routing Enabled. . . . . . . . : No</span></b><span
style='font-size:10.0pt;font-family:"Lucida Console"'> </span><b><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><<<<------
(look here) -----<<<<<<</span></b><span style='font-size:
10.0pt;font-family:"Lucida Console"'><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> WINS Proxy Enabled. . . . . . . . :
Yes<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'>Ethernet adapter Local Area Connection:<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Connection-specific DNS Suffix
. :<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Description . . . . . . . . . . . :
Realtek RTL8169/8110 Family Gigabit Ethernet NIC<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Physical Address. . . . . . . . . :
08-54-3F-00-F0-EF<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Dhcp Enabled. . . . . . . . . . . :
No<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> IP Address. . . . . . . . . . . . :
192.168.0.20<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Subnet Mask . . . . . . . . . . . :
255.255.0.0<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> Default Gateway . . . . . . . . . :
192.168.1.1<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'> DNS Servers . . . . . . . . . . . :
68.238.128.14<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Lucida Console"'>
68.238.64.14<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Lucida Console"'>C:\><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Lucida Console"'><o:p> </o:p></span></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>-</span><span style='font-size:7.5pt;font-family:"Arial","sans-serif";
color:black'>- </span><span style='color:#1F497D'><br>
</span><span style='font-size:13.5pt;font-family:"Arial","sans-serif";
color:black'> "</span><b><span style='font-family:"Arial","sans-serif";
color:green'>Fish</span></b><span style='font-size:13.5pt;font-family:"Arial","sans-serif";
color:black'>"</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'> (</span><span style='font-size:10.0pt;font-family:"Comic Sans MS";
color:purple'>David B. Trout</span><span style='font-size:10.0pt;font-family:
"Arial","sans-serif";color:#1F497D'>)</span><span style='color:#1F497D'> <br>
</span><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#1F497D'> </span><span style='color:#1F497D'> </span><u><span
style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>fish@softdevlabs.com</span></u><span
style='color:#1F497D'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>Gianluca Varenni<br>
<b>Sent:</b> Thursday, May 13, 2010 8:46 AM<br>
<b>To:</b> rouli.net@gmail.com<br>
<b>Cc:</b> winpcap-users<br>
<b>Subject:</b> Re: [Winpcap-users] Injected packets are duplicated on vmware<br>
<b>Importance:</b> High<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Packet
duplication is usually caused by the virtual NIC drivers of vmware (or in any
case their networking virtualization layer). I've seen this kind of problems
with vmware workstation, but I've never used vCenter (which I believe is just a
management tool for a cloud of VMs using VMware server or something similar).</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Have a nice
day</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>GV</span><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a
href="mailto:rouli.net@gmail.com" title="rouli.net@gmail.com">rouli</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>Sent:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Thursday, May 13,
2010 8:31 AM<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>To:</span></b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'> <a
href="mailto:gianluca.varenni@cacetech.com"
title="gianluca.varenni@cacetech.com">Gianluca Varenni</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>Cc:</span></b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'> <a
href="mailto:winpcap-users@winpcap.org"
title="mailto:winpcap-users@winpcap.org CTRL + Click to follow link">winpcap-users</a>
<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>Subject:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Re: [Winpcap-users]
Injected packets are duplicated on vmware<o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'>vCenter 4.0.0<br>
After some digging, I don't believe the problem is with the VMWare, but rather
with vista.<br>
I have installed the same vista image on a physical machine, and still see
packet duplication.<br>
<br>
Since it's only got Service Pack 1 installed, I'm now installing Service Pack 2
and will check whether the problem persists.<br>
<br>
<br>
<br>
<br>
<o:p></o:p></p>
<div>
<p class=MsoNormal>On Thu, May 13, 2010 at 5:59 PM, Gianluca Varenni <<a
href="mailto:gianluca.varenni@cacetech.com"
title="mailto:gianluca.varenni@cacetech.com CTRL + Click to follow link">gianluca.varenni@cacetech.com</a>>
wrote:<o:p></o:p></p>
<div name="Compose message area">
<div>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Which
version of vmware are you using?</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Have a nice
day</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>GV</span><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a
href="mailto:rouli.net@gmail.com" target="_blank" title="rouli.net@gmail.com">rouli</a>
<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>Sent:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Thursday, May 13,
2010 6:04 AM<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>To:</span></b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'> <a
href="mailto:winpcap-users@winpcap.org" target="_blank"
title="winpcap-users@winpcap.org">winpcap-users</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:
10.0pt;font-family:"Tahoma","sans-serif"'>Subject:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> [Winpcap-users]
Injected packets are duplicated on vmware<o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>I'm trying to figure out a setup issue and would appreciate
any help.<br>
I have a vista virtual machine and a program that injects packet to the network
using winpcap.<br>
Every injected packet is duplicated, where the second packet is the exact copy
of the original packet but only the IP's checksum and TTL are changed (TTL
decreased by one).<br>
For example, if I inject an ICMP echo request using winpcap, the target machine
actually gets two requests.<br>
<br>
The duplication happens on the vista machine - I've validated this by using
wireshark.<br>
<br>
Any ideas of what can cause such an issue?<br>
<br>
Thanks<o:p></o:p></p>
</div>
</div>
</div>
<div class=MsoNormal align=center style='text-align:center'>
<hr size=2 width="100%" align=center>
</div>
<p class=MsoNormal>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>