Duplicated packets

[Mahdavi]

😥 😥 😥

having a ping on 4.2.2.4 from my machine 192.168.1.2 and using wireshark

before installing winpkfilter

after installing winpkfilter and before running passthru

and

😥 😥 😥 😥 😥

after running passthru

I should mention that all thing was ok some month ego.

also this is the output of passthru

as you can see the passthru cant see the duplicate packets ??!!!

what happened to dear winpkfilter on my machine??

I have wmware installed (version 8.0.2 build-591240.) I did delete all interfaces of wmware (and also all other interfces else than wireless and again I can see the duplicates. )

I am using win7 64bits on my laptop.

also where can I find non lwf installation of winpkfilter ??? I want to give it a try.

hope I can get the answer.

the following is the list of my interfaces.

Windows IP Configuration

Host Name . . . . . . . . . . . . : mahd
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter loop3:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Loopback Adapter #3
Physical Address. . . . . . . . . : 02-00-4C-4F-4F-50
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::948f:f565:6722:bd3d%24(Preferred)
Autoconfiguration IPv4 Address. . : 169.254.189.61(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 671219788
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-C3-4A-98-00-26-B9-0A-86-42
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter loop2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Loopback Adapter #2
Physical Address. . . . . . . . . : 02-00-4C-4F-4F-50
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::8d7a:17b7:1938:4df2%23(Preferred)
Autoconfiguration IPv4 Address. . : 169.254.77.242(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 419561548
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-C3-4A-98-00-26-B9-0A-86-42
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter loop1:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Loopback Adapter
Physical Address. . . . . . . . . : 02-00-4C-4F-4F-50
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.20.201(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter #2
Physical Address. . . . . . . . . : 70-1A-04-54-C2-96
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Dell Wireless 1397 WLAN Mini-Card
Physical Address. . . . . . . . . : 70-1A-04-54-C2-96
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Tuesday, May 15, 2012 10:32:34 AM
Lease Expires . . . . . . . . . . : Friday, May 18, 2012 10:32:34 AM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 8.8.8.8
4.2.2.4
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Physical Address. . . . . . . . . : 00-26-B9-0A-86-42
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) #2
Physical Address. . . . . . . . . : 70-1A-04-1D-89-22
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

[Mahdavi]

😥

I uninstalled vmware.
nothing changed.

I removed any other interfaces else wireless.
nothing changed.

after uninstalling vmware, I installed and uninstalled and uninstalled winpkfilter.
nothing changed.

after any install and uninstall I restarted windows,
nothing changed.

I used a fresh copy of win7 64 bit and installed winpkfilter driver,
no duplicates.

After that I installed vmware 8 on that machine,
no duplicates.

after that I reinstalled winpkfilter on that machine
no duplicate.

I have 3 computers with duplicates and other 3 computers working nicely.

I concluded that there are garbage while uninstalling winpkfilter.

What is the workaround about this problem ? how can I get sure that there is no trace of winpkfilter after uninstalling it.

I do not want to format my computers.
😥

😥

[Vadim Smirnov]

Do you have any other protocols besides TCP/IP installed/enabled on systems where you expirience the duplicates? Packet duplication is related to protocol-miniport bindings (an example, when you run Wireshark you have one extra binding for winpcap protocol driver) and loopback packets indications (each outgoing packet from one protocol driver is indicated to every other bound protocol, each incoming packet is indicated to every installed protocol). I think in some cases a sort of mess up is possible especially if you use bridging drivers (which is actually protocol driver which works as packet repeater). If you uninstall WinpkFilter it is fully removed from the stack and plays no role in packet processing. So probaly duplicates caused by some other network components installed on your computer.

[Author]

Posts