Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've downloaded NM 3.4 from microsoft.com and it appears that the software doesn't capture traffic on MS TCP Loopback interface. When I ping 127.0.0.1 address, NM shows no packets flowing. I've tried both promiscuous / standard NIC mode with no luck. The only way I know so far to capture loopback traffic on Windows machines is to use RawCap.

I'm using Windows XP SP3.

Regards.

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

This is "impossible" with Windows because the Microsoft TCP/IP stack does not have a loopback interface like BSD systems do. In fact, you can't see traffic that is sent from one Windows PC to any IP address that is bound to a local NIC, even if they're non loopback addresses.

Having said the above, you can use a tool that utilizes raw sockets in Windows to capture any and all traffic that is being moved around in the PC. An example of such a tool would be RawCap. You would then save the capture that RawCap takes and import it into Network Monitor to examine.

Here are some references that should get you going in the right direction:

  1. Ethereal's discussion on loopback interface traffic
  2. StackOverflow question: Windows packet sniffer that can capture loopback traffic?
share|improve this answer
add comment

I don't think it's possible with packet capture tools since the packets never hit the interface. You have to use a proxy of some sort.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.