Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Npcap 0.992 - Duplicate packets #1576

R-Smith opened this issue Apr 27, 2019 · 2 comments


None yet
1 participant
Copy link

commented Apr 27, 2019

I'm seeing a similar problem seen in the closed issue #1055.

Basically I'm seeing duplicated outbound packets in Wireshark with Npcap. I do not see the issue when using WinPcap. The person who posted issue #1055 said that toggling the Npcap driver on the network adapter would temporarily fix the issue, however, this does not seem to work for me. When viewing in Wireshark, the timestamps of the duplicated packets are a few nanoseconds apart. The receiving end does not see the duplicate packets, so it's not actually transmitting them. I've seen the issue on multiple machines and Npcap versions, but my current setup is:

Npcap 0.992
Windows 10 1809
Wireshark 3.0.1


This comment has been minimized.

Copy link

commented Apr 27, 2019

To add to the issue - I also see duplicate inbound packets, but only when communicating with a VM that I have running within VMware Workstation (the VM's network adapter is in bridged mode, not NAT mode).

To recreate:

  • Host system: Npcap 0.992, Windows 10 1809 running Wireshark 3.0.1.
  • Linux VM running in VMware Workstation Player 12 with tcpdump going.
  • I send a single SYN packet from my host machine to my VM at
  • Wireshark shows two SYN packets from the host and two RST packets from my VM at
  • tcpdump on the VM shows one SYN packet from the host and one RST packet from the VM.

This comment has been minimized.

Copy link

commented Apr 28, 2019

Another update. I've narrowed the issue down to only occurring if I have at least one VM running in VMware Workstation with the NIC configured in bridged mode. This is why I've seen the issue on multiple machines. I generally always have VMware Workstation running and my VMs are always in bridged mode. I've also updated Workstation Player to the latest version 15, but there was no change. And again, this issue does not happen at all if I use WinPcap.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.