[Winpcap-users] RARP Storm upon starting winpcap

[Gianluca Varenni]

Absolutely no idea. And the fact that it happens on linux with libpcap is pretty weird. Both the windows machine and the linux one are Vmware guests, i suppose. Right? If so, are you using the original linux/windows drivers for the virtual nic on the guest, or the one provided by vmware?

Have a nice day
GV

  ----- Original Message ----- 
  From: Michael Domberg 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, April 16, 2008 11:44 PM
  Subject: [Winpcap-users] RARP Storm upon starting winpcap


  Hi,
  I am using Microsoft Windows Server 2003 with winpcap 4.0.2 on VMWare ESX 3. Everytime I start a capture (with Windump or Wireshark 1.0.0) winpcap sends a couple of RARP requests. It seems like my host is trying to resolve its own MAC-address. The amount of requests changes from time to time. Sometimes only 3 requests are generated, sometimes up to 500. Even if I stop capturing some RARP packets are sent over the network. The capturing host can't see its own RARP requests, all other host in the same subnet receive all packets. If two or more hosts within the local network use winpcap these requests block all other traffic. This even occurs with libpcap on linux if the linux host is in the same network.
  All searches in the mailing list, google groups and google were to no avail.

  Any suggestions?

  Michael.



------------------------------------------------------------------------------
  Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.


------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20080422/8ed8eed1/attachment.htm