Score:0

Duplicated UDP packets sent

in flag

We have a few applications that we develop in my company that talk to some hardware via UDP. Recently, we started having issues using these applications on some of our machines (hardware basically refusing the connection with the client).

After investigation, we noticed that duplicated UDP packets are being sent out.

As an example, this is a UDP datagram sent on a healthy machine (using WireShark): enter image description here

This is the duplication on one of the faulty machines: enter image description here

A pcapng file from Wireshark can be found here (look for DNS request from client machine 10.0.9.183).

There are a few things we can rule out:

  • We know this is not an issue with our apps, as even DNS sends duplicated packets. I used this script to send simple UDP datagram and we saw a similar behaviour (see screenshots above)
  • We know this is not a network interface fault, as on a faulty machine, duplicated packets are sent via WiFi, Ethernet, USB-Ethernet adapters etc.
  • We know this is not one particular switch/router that is dodgy as this happens in the office, from home (with and without VPN)
  • Some machines work just fine, some don't. They all run Windows10 (same exact version).

It has to be something wrong with the machine but I have really no idea what to try to fix this. I have updated some of the networking interfaces' drivers on this machine + rolled out a Windows10 update but nothing seemed to fix it.

Of course, a possible fix would be to re-program the hardware such that it knows how to deal with duplicated packets, but we really want to be able to get to the bottom of this and fully understand what is causing the issue.

I'm not a network expert at all, hence me posting this here. Is this behaviour something somewhat common and what could possibly cause this?

Many thanks

us flag
One of the leading principles for network programming is: "Be liberal with what you accept and be strict with what you send." Your hardware is not liberal in accepting traffic. Following this principle allows communication with misbehaving clients. Is the packet capture run on the machine where packets are sent out?
harveyAJ avatar
in flag
Yes I was running packet capture on the machine where packets are sent out
us flag
Can you show full details of the duplicate packets from WIreshark? Or share the pcap file?
harveyAJ avatar
in flag
A fix was rolled out from IT on all our machines over the weekend, which seems to have done the trick. Unfortunately, the laptop on which I had saved network snapshot was completely wiped out (all I have left are these screenshots). I was trying to follow what IT was doing, I saw them disabling/re-enabling a bunch of services, one of them was causing this duplication to happen for some reason. I am trying to find out more from them as I'm really keen to know exactly what was happening. Whatever I can share here, I will!
harveyAJ avatar
in flag
Actually it turns out the fix has not been rolled out to all machines, as I found one on which this issue is still happening. I could therefore generate a pcap file (see the edited question, there's a link that should take you to it)
us flag
They seem to be duplicate except for the IP indentifier. This means that the duplicates are created by Windows network stack. But it is a good question why this duplication happens...
harveyAJ avatar
in flag
Still trying to get some answers from IT
Score:0
br flag

Any updates on this?

We are also facing an issue where udp messages are duplicated on some of our apllications since mid december 2021. Couldn't find a cause yet.

harveyAJ avatar
in flag
Sorry for the late reply. Sadly no, IT rolled out an upgrade and the issue got resolved. I hate to say this but at the time I was a bit busy so when it got fixed "by magic" I didn't take the time to try and pin point what Windows service caused the issue...
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.