Hi, I'm not familiar with vnc, but wrote a checksum routine at one point. Double check that the checksum is correct, easy way is to use etherreal which will show you if checksum is invalid. It's possible that the checksum was inalid and passed through anyway.
If it's not checksum, if vnc is a tunneling tool, then it's possible that the actual payload length could be zero, but there is some kind of header information carried as part of the ip or udp/tcp payload. If so, these could also be affected by modifying the ip addresses. mcd ----- Original Message ----- From: "Cefur" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, December 20, 2004 3:29 PM Subject: [WinPcap-users] WinpCap as "proxy" problems > Info: > I am using Snoop component (Delphi) and winpcap 3.1 beta 4. > > Problem: > I had done a sniffer which "sniffs" on two separate NIC's and also sends > packets through each other. It works like a bridge. I had to do this for > some project and everything works ok. > > Then I have said it to myself that this could work as an sort of proxy. So I > connected computer1 to the internet on NIC1 and the other computer2 to the > NIC2. > > Then I ran a vnc program on the computer2 to see if I can get response from > the computer3 on the internet (through the computer1). > > So what happens is next: > an initial packet from computer2 comes to NIC2 where I capture this packet > change its source eth and ip to the NIC1 values, recalculate Checksum and > send it forward through NIC1. Then I get the response (packet) on NIC1 from > the computer3. Then I change its dest. eth and ip to the computer2 NIC > values and send it through NIC2. So far everything works ok. But when packet > is received by the vnc program it behaves like it is a wrong/no good packet > and resends the initial packet??? Btw in both packets the data length is 0. > > If I run vnc program from computer1 everything works ok (the data length of > the first two (send/receive) packets is also 0). Can anybody explain why?? > Of course the latency is much to high for any good usage but still it was > just a test for fun and I don't know why it won't work. Any ideas, > explanation, etc? > > Thx. > > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
