[Winpcap-users] Injected packets duplicated on Vista (was: vmware)

[rouli]

esx

On Sun, May 16, 2010 at 7:46 PM, Jack Jackson <jack at pebbleridge.com> wrote:

>  Is your virtual machine running on VMWare Server or ESX?
>
>
> At 04:20 AM 5/16/2010, rouli wrote:
>
> And on the virtual vista machine duplication only occurs when IP routing is
> enabled.
> here's the routing table, can someone see what is configured wrong that may
> cause such a problem?
> I'm inject a ping request packet whose destination address is 192.168.1.28
> and send it through the interface owning 192.168.1.61
>
>
> ===========================================================================
> Interface List
>  23 ...00 50 56 85 06 aa ...... Intel(R) PRO/1000 MT Network Connection #3
>  21 ...00 50 56 85 36 4b ...... Intel(R) PRO/1000 MT Network Connection #2
>  19 ...00 50 56 85 5b 12 ...... Intel(R) PRO/1000 MT Network Connection
>   1 ........................... Software Loopback Interface 1
>  26 ...00 00 00 00 00 00 00 e0
> isatap.{EB4B88C1-BB53-44F4-93B1-4136C7DB6851}
>  25 ...00 00 00 00 00 00 00 e0
> isatap.{FDB3ED54-237A-4F75-801A-376BA00E0C25}
>  27 ...00 00 00 00 00 00 00 e0  isatap.engulfix.net
> ===========================================================================
>
> IPv4 Route Table
> ===========================================================================
> Active Routes:
> Network Destination        Netmask          Gateway       Interface  Metric
>         127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
>         127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
>   127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
>       192.168.1.0    255.255.255.0         On-link      192.168.1.61     11
>      192.168.1.61  255.255.255.255         On-link      192.168.1.61    266
>      192.168.1.76  255.255.255.255         On-link      192.168.1.76    266
>      192.168.1.77  255.255.255.255         On-link      192.168.1.77    266
> ===========================================================================
> Persistent Routes:
>   None
>
> IPv6 Route Table
> ===========================================================================
> Active Routes:
>  If Metric Network Destination      Gateway
>   1    306 ::1/128                  On-link
>   1    306 ff00::/8                 On-link
> ===========================================================================
> Persistent Routes:
>   None
>
>
>
> On Sun, May 16, 2010 at 11:20 AM, rouli <rouli.net@ gmail.com> wrote:
>  Ok, I've fixed the problem on the physical machine, though I'm not sure
> what made it go away, and I still have it on the virtual machine.
> On the physical machine there are three network cards, only one was
> actually connected to the network - the other two were unplugged. Moreover,
> the two unplugged cards had a static ip address configured which didn't
> match our network mask. Once I set those two cards to obtain a dynamic
> address, the duplication has stopped (weird, huh?). I've since tried to
> recreate the problem, but failed to do so; And as I've mentioned, I still
> got it on the virtual machine whose image was taken from the physical
> machine, even though on it all network cards are configured properly.
>
>
>
> On Thu, May 13, 2010 at 6:45 PM, Gianluca Varenni <gianluca.varenni at cacetech.com>
> wrote:
>  Packet duplication is usually caused by the virtual NIC drivers of vmware
> (or in any case their networking virtualization layer). I've seen this kind
> of problems with vmware workstation, but I've never used vCenter (which I
> believe is just a management tool for a cloud of VMs using VMware server or
> something similar).
>
> Have a nice day
> GV
>
> From: rouli <rouli.net at gmail.com>
> Sent: Thursday, May 13, 2010 8:31 AM
> To: Gianluca Varenni <gianluca.varenni at cacetech.com>
> Cc: winpcap-users <winpcap-users at winpcap.org>
> Subject: Re: [Winpcap-users] Injected packets are duplicated on vmware
>
> vCenter 4.0.0
> After some digging, I don't believe the problem is with the VMWare, but
> rather with vista.
> I have installed the same vista image on a physical machine, and still see
> packet duplication.
>
> Since it's only got Service Pack 1 installed, I'm now installing Service
> Pack 2 and will check whether the problem persists.
>
>
>
>
>
> On Thu, May 13, 2010 at 5:59 PM, Gianluca Varenni <gianluca.varenni at cacetech.com>
> wrote:
>  Which version of vmware are you using?
>
> Have a nice day
> GV
>
> From: rouli <rouli.net at gmail.com>
> Sent: Thursday, May 13, 2010 6:04 AM
> To: winpcap-users <winpcap-users at winpcap.org>
> Subject: [Winpcap-users] Injected packets are duplicated on vmware
>
> I'm trying to figure out a setup issue and would appreciate any help.
> I have a vista virtual machine and a program that injects packet to the
> network using winpcap.
> Every injected packet is duplicated, where the second packet is the exact
> copy of the original packet but only the IP's checksum and TTL are changed
> (TTL decreased by one).
> For example, if I inject an ICMP echo request using winpcap, the target
> machine actually gets two requests.
>
> The duplication happens on the vista machine - I've validated this by using
> wireshark.
>
> Any ideas of what can cause such an issue?
>
> Thanks
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100516/f8bfd94e/attachment.htm