Duplicate packets from afpacket.TPacket.ZeroCopyReadPacketData()

[fdevibe]

afpacket.TPacket.ZeroCopyReadPacketData() seems to return duplicate packets. When running in a loop, the function returns twice (iterating the loop twice) for each packet.

By modifying the example in examples/afpacket/afpacket.go with the following patch:

--- main.go.orig	2021-10-27 08:55:43.527613441 +0200
+++ main.go	2021-10-27 08:59:59.462272193 +0200
@@ -176,6 +176,11 @@
 		}
 		bytes += uint64(len(data))
 		packets++
+		packet := gopacket.NewPacket(data, layers.LayerTypeEthernet, gopacket.Default)
+		tcpLayer := packet.Layer(layers.LayerTypeTCP)
+		tcp, _ := tcpLayer.(*layers.TCP)
+		payload := tcp.Payload
+		log.Printf("Payload: '%s'\n", payload)
 		if *count%*verbose == 0 {
 			_, afpacketStats, err := afpacketHandle.SocketStats()
 			if err != nil {

and then running a netcat server:

$ nc -4lp 4321
foo

with a netcat client:

$ nc -t 127.0.0.1 4321
foo

I get the following output

$ sudo ./afpacket -f "dst host 127.0.0.1 and dst port 4321" -s -1 -i lo -log_every 1
2021/10/27 09:00:17 Starting on interface "lo"
2021/10/27 09:00:24 Payload: 'foo
'
2021/10/27 09:00:24 Read in 70 bytes in 1 packets
2021/10/27 09:00:24 Stats {received dropped queue-freeze}: {2 0 1}
2021/10/27 09:00:24 Payload: 'foo
'
2021/10/27 09:00:24 Read in 140 bytes in 2 packets
2021/10/27 09:00:24 Stats {received dropped queue-freeze}: {2 0 1}

So it seems like

data, _, err := source.ZeroCopyReadPacketData()

will actually return the packet data twice, source here being a afpacket.TPacket.

Running

$ sudo tcpdump -i lo dst port 4321

at the same time shows only one packet:

09:00:23.945888 IP localhost.58110 > localhost.rwhois: Flags [P.], seq 12:16, ack 1, win 512, options [nop,nop,TS val 2938365429 ecr 2937467628], length 4

System:

$ go version
go version go1.15.15 linux/amd64
$ uname -a
Linux x1c 5.14.2-arch1-2 #1 SMP PREEMPT Thu, 09 Sep 2021 09:42:35 +0000 x86_64 GNU/Linux

[jschwinger233]

Same issue here. And here is my demonstration code:

package main

import (
	"log"
	"strings"

	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcapgo"
)

func main() {
	handler, err := pcapgo.NewEthernetHandle("lo")
	if err != nil {
		log.Fatalf("failed to new handler: %+v", err)
	}
	packetSource := gopacket.NewPacketSource(handler, layers.LayerTypeEthernet)
	for packet := range packetSource.Packets() {
		appLayer := packet.ApplicationLayer()
		if appLayer == nil {
			continue
		}
		payload := string(appLayer.Payload())
		if strings.Contains(payload, "GET / ") {
			println(payload)
		}
	}
}

[QuincyGao]

I have Same issue, do you fixed this?

[QuincyGao]

this issue is only found in 127.0.0.1 , eth0 hasn't this satuation.

[mosajjal]

if the connection is localhost to localhost, doesn't that mean that it would be the expected behavior to see the same packet twice? once in "source" and one in "dest"?