Duplicate packets from VMware host

asked 2019-04-23 13:41:27 +0000

yash.rohilla
3 ●3 ●4 ●6

Hello,

I'm having an issue where I see duplicate packets sent from a virtual machine. The VMware workstation is running Linux with the network adapter in "Bridged: Connected directly to the physical network" mode. Additionally, the "Replicate physical network connection state" option is checked.

I have Wireshark running on my host machine running Windows 10. When I send ICMP messages from the virtual machine to another device connected to the local network, I see 2 instances of the same ICMP message being sent in Wireshark (that is running on the host machine). When I delve further into these two ICMP requests, I see that one of them has a response frame while the other does not. Am I correct in thinking that this is because I have a bridged connection between the host machine and the virtual machine? Is this expected behavior? Is there anything I can do to not sent duplicate packets? I am only using ICMP to demonstrate the issue. I am trying to setup a three-way handshake between a client and server using scapy, but the duplicate messages are messing up the response I'm expecting from the server (immediate RSTs are sent from the client).

I also have Wireshark running on the virtual machine with Linux. I do not see any duplicate packets on the machine. This makes me believe that this is expected behavior.

Please let me know if you would like any screenshots or further information. I would be happy to oblige.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-04-23 17:36:38 +0000

SYN-bit

18528 ●9 ●338 ●255 https://SYN-b.it

My guess would be that thet duplicate packets are an artefact of capturing on the host machine itself. When you see two SYN packets in your trace, do you also see two SYN/ACK packets coming back? If not, there was actually only one SYN packet leaving your system.

It is recommended to make traces on a separate machine running Wireshark. Either connected to a TAP or a SPAN port, that way, you can be sure of what is actually put on the network without having to guess how the vNic driver, hypervisor kernel, nic offloading features etc are creating all sorts of strange capture effects.

Have a look at the Wireshark WiKi page on how to capture for more information.

edit flag offensive delete link

Comments

Hi SYN-bit,

I do not see two SYN/ACK packets coming back, which confirms that only one SYN packet leaves my VM.

Thank you for your help! I will setup the capture after reviewing the guide.

yash.rohilla ( 2019-04-24 08:10:31 +0000 )edit

add a comment

answered 2023-12-05 04:59:03 +0000

Rooster_50

254 ●10 ●21 ●26

updated 2023-12-05 05:00:55 +0000

I know this is an old post, but I did find a "somewhat" workaround to eliminate the duplicate packets when capturing on VMWare workstation host PC.

I am not sure when this was implemented, but in Wireshark version 4.2.0 (Windows 64-bit) you can go to: [EDIT > PREFERENCES] and then click on "Protocols" on the left-side pane (without expanding), and you will see an option for "Ignore duplicate frame". That option has eliminated the duplicate frames issue when capturing on a VMWare host.

NOTE: don't forget to disable it for normal packet analysis, as it could cause switching/routing loops to go unnoticed.

Hope that helps.

edit flag offensive delete link

Comments

It's a pretty new addition - June 2023.
10956: Add a preference for ignoring duplicate frames
Commit d2c9f182: Add a preference for ignoring duplicate frames
10982: Change how the packet dedup structures are handled during a live capture

Chuckc ( 2023-12-05 13:35:43 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Duplicate packets from VMware host

2 Answers

Comments

Comments

Your Answer

Question Tools

Stats

Related questions

Duplicate packets from VMware host edit

2 Answers

Comments

Comments

Your Answer

Question Tools

Stats

Related questions

Duplicate packets from VMware host