Ask Your Question
0

why outbound packets logged twice on vEthernet

asked 2024-07-15 10:12:43 +0000

updated 2024-07-15 19:33:48 +0000

Guy Harris gravatar image

I'm using WSL on Windows and found that almost every packet sent from Windows to WSL is retransmitted image descriptionimage description

edit retag flag offensive close merge delete

Comments

Did you do this capture with a Windows application (such as the Windows version of Wireshark), or did you do it with a Linux application (such as the "neither Windows nor macOS" version of Wireshark)?

Guy Harris gravatar imageGuy Harris ( 2024-07-15 19:33:31 +0000 )edit

hello harris,I captured the data on the host side,which is windows

shaohua.ou gravatar imageshaohua.ou ( 2024-07-16 02:49:18 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2024-07-16 05:23:10 +0000

Guy Harris gravatar image

I captured the data on the host side,which is windows

Perhaps, as the vEthernet device is, in effect, a local loopback/wraparound device, any time a packet is transmitted on the adapter, it's then received by the "other side" of the adapter, and NDIS sees both packets and delivers both of them to the WinPcap or Npcap driver, so you get two copies.

If you're using Npcap (which is what current versions of Wireshark installs) rather than WinPcap (which hasn't been the default in a while), you might want to report this on the Npcap issue list, as the Npcap developers have more resources and time to look at this, and more familiarity with the Npcap code.

edit flag offensive delete link more

Comments

ok,thank you for your answer

shaohua.ou gravatar imageshaohua.ou ( 2024-07-16 07:46:38 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-07-15 10:12:43 +0000

Seen: 77 times

Last updated: Jul 16