Ethereal-users: RE: [Ethereal-users] Duplicate packet display in MS Windows 0.8.1 7 - 'Determ

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Adrian Johnson <adrian@xxxxxxxxxxxxxxxxx>
Date: Tue, 19 Feb 2002 10:11:08 -0000
Folks
 
> On Thu, Feb 14, 2002 at 06:55:50PM -0000, Adrian Johnson wrote:
> > I have Win2K, Ethereal 0.9.1, WinPcap 2.2 and this occurs 
> for me too.
> 
> It will probably also occur with WinDump or Analyzer or any other
> libpcap-based application, i.e.  it's probably not Ethereal that's
> duplicating stuff, it's probably WinPcap that's duplicating stuff.
> 
> Therefore, you might want to ask the WinPcap maintainers:
> 
> 	winpcap@xxxxxxxxxxxxxxxxxxxxxxx
> 
> about it.  (I have no idea whatsoever what's causing the problem.)

I tracked it down at last!

I have discovered through trial, error and chance (the Etherpeek support
pages) that the problem is indeed due to the SafeNet VPN client.  Those of
you that use it, or similar, may have noticed that a 'Deterministic Network
Enhancer' component has been added to your NIC properties.  

If you disable it for the duration of the capture, everything works fine
(you can leave the IPSecMon and IREIKE services running) - in W2K you don't
even need to reboot.  However, you may need to reboot to get the VPN client
to work again...

This is indeed a WinPcap problem so I will be reporting it there also but I
thought as an FYI, it would be useful for all y'all here too since I only
found it by wanting to use Ethereal :^)

Regards,
            Ade!