Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs using the loopback interface), which is

When I run Wireshark on the server, I do not see any of the traffic going between the three applications. I added a route to the server to forward traffic destined for to my LAN's gateway, in which case I now see SYN packets for the traffic. However, I don't see anything come back.

Bottom line is... has anyone had success capturing local traffic on a Windows Server 2008 R2 machine?

share|improve this question

migrated from Jun 15 '11 at 22:25

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

It's explained here why it's not possible on the Wireshark wiki, together with some workarounds. Basically traffic local to the host is routed within the Windows TCP stack so never makes it to the interface layer which is where Wireshark listens (via winpcap). So without the workarounds behind that link, no it's not possible.

share|improve this answer
Thanks Chris, Proxocket worked for me. – Bryan Dec 16 '11 at 14:52

you minght try netmon which is microsoft's network monitor. It appears to add itself as a network service, so it might work.

share|improve this answer
Thanks for the suggestion Jim, but netmon did not work for capturing local traffic. – Bryan Dec 16 '11 at 14:50
Good to know- thanks for the update. – Jim B Dec 16 '11 at 19:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.