Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs using the loopback interface), which is 192.168.106.1.

When I run Wireshark on the server, I do not see any of the traffic going between the three applications. I added a route to the server to forward traffic destined for 192.168.106.1 to my LAN's gateway, in which case I now see SYN packets for the traffic. However, I don't see anything come back.

Bottom line is... has anyone had success capturing local traffic on a Windows Server 2008 R2 machine?

share|improve this question

migrated from stackoverflow.com Jun 15 '11 at 22:25

2 Answers

up vote 2 down vote accepted

It's explained here why it's not possible on the Wireshark wiki, together with some workarounds. Basically traffic local to the host is routed within the Windows TCP stack so never makes it to the interface layer which is where Wireshark listens (via winpcap). So without the workarounds behind that link, no it's not possible.

share|improve this answer
Thanks Chris, Proxocket worked for me. – Bryan Dec 16 '11 at 14:52
up vote 1 down vote

you minght try netmon which is microsoft's network monitor. It appears to add itself as a network service, so it might work.

share|improve this answer
Thanks for the suggestion Jim, but netmon did not work for capturing local traffic. – Bryan Dec 16 '11 at 14:50
Good to know- thanks for the update. – Jim B Dec 16 '11 at 19:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.