Duplicated packets reproduced

[weihao.ma]

Hi,

When I test the gretunnel sample with two vmware guest OS(one is XP OS, and the other is Win2003 OS), I encountered the duplicated packets issues as the another post on forum regarding duplicated packets, but the duplicated packets phenomenon will reproduce only in the case of Winpkfilter with NDIS-IM driver, and in the same environment, the NDIS-Hook driver works fine!

Testing environment and process as following:
1. Vmware Host is WIN7 64bit, set both the guest VMware network connection to bridged mode
2. Vmware Guest OS A: XP 32bit + winpkfilter(NDIS-IM driver), ip: 192.168.1.4
3. Vmware Guest OS B: WIN2003 32bit + winpkfilter(NDIS-IM driver) + Wireshark(only for packets monitor), ip: 192.168.1.7
4. Before testing the gretunnel sample, both guest vmware os can ping throught each other.
5. Runing greturnnel sample in both system, when I ping 192.168.1.4 at B, B can ping throught A, but I found the wireshark shows the duplicate packets, one is original icmp packet, and another is gre-packet.

[attachment=0:3bbuqpje]QQ截图20121012004705.png[/attachment:3bbuqpje]

P.S. Perhaps because of the protocol driver of the Winpcap, the above Wireshark’s output is correct, but in my serveral tests, which I once saw in Wireshark shows two packets is exactly the same. Tomorrow I will continue to testing the gretunnel sample, when the next time I reproduced such a situation, I will upload the screenshots.

[Vadim Smirnov]

NDIS-hook driver intercepts the particular binding between TCP/IP and network interface, while NDIS IM and LWF drivers intercept all bindings (between all installed protocols and network adapters). This explains the different behaviour.

[Author]

Posts