search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
3.03k stars 519 forks source link

Windows 10 sendPacket not working #301

Open neighbads opened 3 years ago

neighbads commented 3 years ago

System: Windows 10 1904 npcap : npcap-sdk-1.07.zip npcap-1.20.exe

I ping ip by ping 10.0.61.1 -n 1 and copy as hex stream from Wireshark. Then send by 

int pcap_sendpacket(pcap_t *, const u_char *, int);

Ping request show in Wireshark. But no response(remote ip is good).

Wireshark screenshot： Dingtalk_20210412161339

This is test pcap file: icmp.zip

bubbasnmp commented 3 years ago

In the Protocol Preferences for Frame, you can have Wireshark calculate a MD5 hash of each frame.
They match so the frames are identical.
Can you capture at the remote end to see if anything in the middle is blocking this as an ICMP replay issue?
Or perhaps the receiving end doesn't respond to duplicate requests?

dmiller-nmap commented 3 years ago

Thanks for reporting this issue. The problem may have to do with duplicate ICMP sequence numbers being ignored by the target. You can verify this by checking if any of the following are true:

  1. A packet sniffer on the target shows both packets arriving.
  2. Modifying the ICMP sequence number in the packet before sending results in a good response (you will have to update the IP checksum).
  3. Sending the packet after a longer delay (e.g. 1 minute after the original) results in a good response.

Please let us know if any of these tests work for you.

neighbads commented 3 years ago

When I change wlan to cable directly connected, it is good.

I don't know why all same packet can not send to remote in wlan.

desc

test_icmp2.zip