Why packets injected with libpcap are duplicated?

Question

I'm using sharppcap in order to send packets as part of a monitoring system. Usually it works well but I've encountered the strangest bug on a hosted vista machine and I would like your help.

On that virtual vista machine, injected packets are duplicated. That is, if I send a ping request using libpcap, it somehow gets duplicated and I get two requests on the destination machine. The two requests are almost identical byte-wise, and the only difference between them is that the second packet's TTL field is one minus the original packet's value.

Using wireshark I can see the packet gets duplicated before it (and its clone) leave the vista machine. The problem is manifested even when using other tools for injecting packets using libpcap (namely PlayCap).

Any ideas?

Answer 1

The TTL field being one lower on the clone packet indicates that it has gone through one more routing hop than the other packet. This seems to indicate that the packet has gone through the Vista machine's input packet queue (and is routed back out) as well as directly to its output queue.