Stuart Cove Stuart Cove - 2 months ago 10
C# Question

BeginReceiveFrom callback method called only when running a packet sniffer

I'm using asynchronous sockets to send and recieve UDP packets. The sending part of things works fine, but the receiving side of things is not working, with the callback method never called.

However, when i ran Wireshark to check that the UDP datagrams were arriving, suddenly the callback is executed. Could anyone shed some light on why this should be?



Wireshark puts your NC into promisuous mode - you are sth like sniffer. Then you can get packets, that are not intended to you.

Perhaps you send packet with some changed fields, that makes NC in "normal" mode can't see him?

E.g ICMP Echo:

ICMP is the protocol behind the ping command. To ping a machine, you send an ICMP Echo request packet to it and wait for an ICMP response one. Usually, the ICMP request is embedded in an Ethernet packet to be delivered across the network. A standard Ethernet packet would include the MAC address of the addressed network card, as well as the IP address of that machine in the embedded ICMP packet. The packet would be detected by the appropriate card and that machine would respond to the ping. This is the standard process.

Now let's see what happens if we sent a ping packet (ICMP Echo request one) with the IP address of the suspected sniffer address but with a different, faulty MAC address in the Ethernet envelope.

  • If the network card in the sniffer machine is not on promiscuous mode, then the packet will not be received by that machine. Naturally, the machine wouldn't respond. The ping attempt would fail.

  • If the network card in the sniffer machine is on promiscuous mode, then the machine will see all packets in the network. The TCP/IP stack on that machine would thus accept the ping packet by identifying the received packet IP address. The stack would thus send a response. The ping attempt would succeed.

Put your code here, it will be easier :)