Capturing double copies in VirtNet Adapter

Home Forums Discussions Support Portal Capturing double copies in VirtNet Adapter

This topic contains 5 replies, has 3 voices, and was last updated by  Vadim Smirnov 7 years, 7 months ago.

Viewing 6 posts - 1 through 6 (of 6 total)
  • Author
    Posts
  • #5196

    schumiimor
    Participant

    Hello, I’m using winpcap capture all packets sent to the VirtNet.

    When using MS LoopBack Adapter, this works great on xp, vista. But unfortunately, the MS LoopBack has issues in Win2000 (can’t capture anything). So I’m using VirtNet in 2000 version of my project. But for some reason, every UDP message sent is captured twice by VirtNet (unlike MS LoopBack). Example: When I send a “Hello”,
    The capture handler gets “HelloHello”, I’m not sure if it is made of two calls to Handler or 1 call with twice the data.
    – Any ideas why the doubling?
    – Any idea how to stop this?
    – Any ideas how I can filter the second one out – fix there is not fix?

    Thanks.

    #6604

    Vadim Smirnov
    Moderator

    May be the reason is in the loopback packet indication. You see packet twice, one time when it is sent and second time when it is indicated back by NDIS (loopback indication) to installed protocols. This is just a version, because I have no idea how you emulate packets on VirtNet.

    #6605

    schumiimor
    Participant

    Thanks for the reply, but it seems that the same driver VirtNet works great on XP. It sends UDP messages out without doubling. I understand this is a loop back driver thus sending to same IP will go all the way down to driver instead of local (127.0.0.1). But when I send from 192.168.1.10 to 192.168.1.5 it should not loopback, just fack an attempt to send it out (this is how it works on XP). But for some reason, only on 2000, it sends this twice. I checked routing tables and they seem fine.

    Any protocol component I have to remove from the settings?

    Thanks

    #6606

    schumiimor
    Participant

    Found the issue, it seems that there is another driver “possibly” the MS loopback (although disabled) that is using the same MAC address of VirtNet. Because of this, it is sending things twice – don’t ask me why and how?!
    But changing the VirtNet MAC address fixed the issue.

    If anyone know how to find how that other driver (and which one) is causing all these anomalies, please share.

    Thanks

    #6607

    lovepkfilter
    Participant

    does every virtnet’s mac is same???? 😯

    #6608

    Vadim Smirnov
    Moderator

    VirtNet has hardcoded MAC address in driver, however you can easily changed it through the network card properties. Driver tries to read MAC address from the registry during driver start.

Viewing 6 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.