npcap icon indicating copy to clipboard operation
npcap copied to clipboard

Windows 10 sendPacket not working

Open neighbads opened this issue 3 years ago • 3 comments

System: Windows 10 1904 npcap : npcap-sdk-1.07.zip npcap-1.20.exe

I ping ip by ping 10.0.61.1 -n 1 and copy as hex stream from Wireshark. Then send by

int	pcap_sendpacket(pcap_t *, const u_char *, int);

Ping request show in Wireshark. But no response(remote ip is good).

Wireshark screenshot: Dingtalk_20210412161339

This is test pcap file: icmp.zip

neighbads avatar Apr 13 '21 01:04 neighbads

In the Protocol Preferences for Frame, you can have Wireshark calculate a MD5 hash of each frame.
They match so the frames are identical.
Can you capture at the remote end to see if anything in the middle is blocking this as an ICMP replay issue?
Or perhaps the receiving end doesn't respond to duplicate requests?

bubbasnmp avatar Apr 13 '21 02:04 bubbasnmp

Thanks for reporting this issue. The problem may have to do with duplicate ICMP sequence numbers being ignored by the target. You can verify this by checking if any of the following are true:

  1. A packet sniffer on the target shows both packets arriving.
  2. Modifying the ICMP sequence number in the packet before sending results in a good response (you will have to update the IP checksum).
  3. Sending the packet after a longer delay (e.g. 1 minute after the original) results in a good response.

Please let us know if any of these tests work for you.

dmiller-nmap avatar Apr 13 '21 23:04 dmiller-nmap

When I change wlan to cable directly connected, it is good.

I don't know why all same packet can not send to remote in wlan.

desc

test_icmp2.zip

neighbads avatar Apr 14 '21 02:04 neighbads