[schumiimor]

Hello, I’m using winpcap capture all packets sent to the VirtNet.

When using MS LoopBack Adapter, this works great on xp, vista. But unfortunately, the MS LoopBack has issues in Win2000 (can’t capture anything). So I’m using VirtNet in 2000 version of my project. But for some reason, every UDP message sent is captured twice by VirtNet (unlike MS LoopBack). Example: When I send a “Hello”,
The capture handler gets “HelloHello”, I’m not sure if it is made of two calls to Handler or 1 call with twice the data.
– Any ideas why the doubling?
– Any idea how to stop this?
– Any ideas how I can filter the second one out – fix there is not fix?

Thanks.

[Vadim Smirnov]

May be the reason is in the loopback packet indication. You see packet twice, one time when it is sent and second time when it is indicated back by NDIS (loopback indication) to installed protocols. This is just a version, because I have no idea how you emulate packets on VirtNet.

[schumiimor]

Thanks for the reply, but it seems that the same driver VirtNet works great on XP. It sends UDP messages out without doubling. I understand this is a loop back driver thus sending to same IP will go all the way down to driver instead of local (127.0.0.1). But when I send from 192.168.1.10 to 192.168.1.5 it should not loopback, just fack an attempt to send it out (this is how it works on XP). But for some reason, only on 2000, it sends this twice. I checked routing tables and they seem fine.

Any protocol component I have to remove from the settings?

Thanks

[schumiimor]

Found the issue, it seems that there is another driver “possibly” the MS loopback (although disabled) that is using the same MAC address of VirtNet. Because of this, it is sending things twice – don’t ask me why and how?!
But changing the VirtNet MAC address fixed the issue.

If anyone know how to find how that other driver (and which one) is causing all these anomalies, please share.

Thanks

[lovepkfilter]

does every virtnet’s mac is same???? 😯

[Vadim Smirnov]

VirtNet has hardcoded MAC address in driver, however you can easily changed it through the network card properties. Driver tries to read MAC address from the registry during driver start.

[Author]

Posts