Outbound multicast packets are received twice in WinDivert if the sender joins the multicast group

[kshahar]

First, I am not sure whether this is a bug or the correct behavior. When sending multicast messages through a specific network interface (e.g. an Ethernet interface) by first joining the multicast group, I am getting duplicate packets returned by WinDivertRecv - one packet where the address has Loopback=1 and one with 0. I am able to reproduce this with the passthru example (WINDIVERT_LAYER_NETWORK), and the result is that each packet is re-injected twice back to the network interface.

Ignoring the packet with addr->Loopback=1 before the following line resolves this:

Divert/examples/passthru/passthru.c

Line 185 in 9710107

if (!WinDivertSendEx(handle, packet, recv_len, NULL, 0, addr,

System details:

• Windows 11 23H2
• Wireshark 4.2.3 and Npcap are installed (including NPF_Loopback)

To reproduce:

1. Run passthru "udp.DstPort == 6000"

2. Run this Sender example* (python), after setting interface_ip:

import socket, time

multicast_group = '224.1.0.4'
multicast_port = 6000
interface_ip = '192.168.10.200' # Replace with desired interface IP

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

# Causes duplicates
sock.setsockopt(socket.IPPROTO_IP , socket.IP_ADD_MEMBERSHIP, socket.inet_aton(multicast_group) + socket.inet_aton(interface_ip))

counter = 0
try:
    while True:
        counter += 1
        message = str(counter).encode('utf-8')
        sock.sendto(message, (multicast_group, multicast_port))
        time.sleep(0.1)
except KeyboardInterrupt:
    pass
finally:
    sock.close()

3. In Wireshark, start a capture on an Ethernet device with the capture filter set to udp port 6000. You should see duplicate packets being captured (identical in body).

* Alternatively, use gstreamer to reproduce (my original use case):

gst-launch-1.0 audiotestsrc is-live=true ! audioconvert ! rtpL16pay ! multiudpsink clients=224.1.0.4:6000 multicast-iface=Ethernet