0

I have two interfaces IF-A:10.0.0.1 and IF-B:172.20.29.152.

Sending broadcasts to both interfaces should generate 2 packets:

var udp = new UdpClient();
var target1 = IPAddress.Parse("10.255.255.255");
var target2 = IPAddress.Parse("172.20.255.255");

udp.Send(new byte[0], 0, new IPEndPoint(target1, 80));
udp.Send(new byte[0], 0, new IPEndPoint(target2, 80));

I ran wireshark and saw that 4 Packets went out from my pc. I found out, that each call of "udpClient.Send" creates TWO identical packets - one for each interface:

// First Send()
IF-A: from   10.0.0.1        to   10.255.255.255    (OK)
IF-B: from   10.0.0.1        to   10.255.255.255    (WTF?)

// Second Send()
IF-A: from   172.20.29.152   to   172.20.255.255    (WTF?)
IF-B: from   172.20.29.152   to   172.20.255.255    (OK)

This makes absolutely no sense to me.

Details:

Packet dump (4 Packets): http://pastebin.com/i71NZhaU Packet summary

Erik Philips
  • 53,428
  • 11
  • 128
  • 150
Tho Mai
  • 835
  • 5
  • 25
  • are you sure you're not misinterpreting the wireshark output? Can you post a screenshot of the output maybe? – Eren Ersönmez Feb 06 '15 at 12:15
  • I added the screenshot and the packet dump. 100% sure as you can see in the dump. – Tho Mai Feb 06 '15 at 12:25
  • After reading http://stackoverflow.com/questions/683624/udp-broadcast-on-all-interfaces, I improved the code. Previously the packet's destination has been 255.255.255.255. Now it's more specific, like 10.255.255.255. And since the behavior didn't change, it makes less sense than before... – Tho Mai Feb 06 '15 at 13:14
  • you might take another look using [procmon](https://technet.microsoft.com/tr-tr/sysinternals/bb896645.aspx). Or write a quick app to actually receive the udp packets to see if it's really sending duplicates. it's been a while, but I've run into duplicate capture issues in wireshark before. – Eren Ersönmez Feb 06 '15 at 13:32
  • I triple checked. The packets are definately on the wire :) – Tho Mai Feb 06 '15 at 13:40

1 Answers1

0

I think that Eren might be right. Look at the src mac addresses of the outgoing packets. Both frames from 10.0.0.1 have a src mac 60:67:20:ca:a6:2c and both from 172.20.29.152 have src mac of d4:be:d9:84:43:b8.

Ethernet II, Src: IntelCor_ca:a6:2c (60:67:20:ca:a6:2c), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 10.0.0.1 (10.0.0.1), Dst: 10.255.255.255 (10.255.255.255)

Ethernet II, Src: DellInc_84:43:b8 (d4:be:d9:84:43:b8), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 172.20.29.152 (172.20.29.152), Dst: 172.20.255.255 (172.20.255.255)

Ethernet II, Src: DellInc_84:43:b8 (d4:be:d9:84:43:b8), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 172.20.29.152 (172.20.29.152), Dst: 172.20.255.255 (172.20.255.255)

Ethernet II, Src: IntelCor_ca:a6:2c (60:67:20:ca:a6:2c), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 10.0.0.1 (10.0.0.1), Dst: 10.255.255.255 (10.255.255.255)

I'm no expert in C# but I see no reason why would it send two datagrams so my assumption is that both of your NICs are in the same VLAN on the switch and that first two frames you see in your dump are the outgoing frames, and the second two are incoming frames.

So when you send the frame from 60:67:20:ca:a6:2c (interface 0 with 10.0.0.1 in your dump) to ff:ff:ff:ff:ff:ff the switch will forward that frame on all interfaces in the same vlan except the one it received the frame on. It doesn't look at the IP addresses so if the port connected to your interface with d4:be:d9:84:43:b8 (interface 1 with 172.20.29.152 in your dump) is configured to be in the same vlan as the other interface you will receive the frame on it. And the same thing will happen for the other frame.

pajaja
  • 2,164
  • 4
  • 25
  • 33
  • Yes, that's it. The Wifi-Hotspot used for this test (10.0.0.1) had been connected to the internal LAN ... – Tho Mai Feb 09 '15 at 07:19