Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two applications a client and a server running on my local machine and want to monitor their network traffic through NetMon.

One solution is to route the local traffic through the default gateway. However, I never got this working. It should be as easy as adding the following route:

net add <localip> MASK <mask> <defaultgatway> METRIC 1 IF 1

Result:

===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
      87.198.54.0    255.255.255.0      87.198.54.9     87.198.54.9       25
--->  87.198.54.0    255.255.255.0      87.198.54.1     87.198.54.9       1
      87.198.54.9  255.255.255.255        127.0.0.1       127.0.0.1       25
   87.255.255.255  255.255.255.255      87.198.54.9     87.198.54.9       25
Default Gateway:       87.198.54.1
===========================================================================

--->  87.198.54.0    255.255.255.0      87.198.54.1     87.198.54.9       1

So I would expect that this route routes everything to 87.198.54.9 to the gateway. It doesn't.

The approach is described in the following Technet slides. So I am pretty sure there must be a way to make this work....

http://download.microsoft.com/download/2/F/3/2F3ABBCF-E3BD-4FC0-85CA-134763E7A129/2009-03-12%5FTechDays%5FTechNet%5F037.pptx

Any ideas why the route doesn't work?

QUESTION MADE MORE SPECIFIC:

I run a ping on local machine to my local machine.

How can I see the ICMP packets in MS NetMon?

Thanks, Alex

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Monitoring local traffic on Windows is dodgy, at best. The method you're describing won't work for traffic bound for 127.0.0.1. As far as I know, there's no simple way to get that traffic into any sniffer.

Assuming you're looking to capture a TCP-based protocol, I'd install a build of rinetd (Windows binary available at that link) on a remote computer with a configuration to listen on the appropriate port and send the traffic back to the listening program back on your machine. Then the traffic will be sent across the wire and you can catch it with NetMon.

I've used this "remote proxy back to the local machine" technique on many occasions to great success.

share|improve this answer
    
Thanks for the link to Wireshark! –  Alex Dec 6 '09 at 23:52
add comment

The problem was in the route:

Instead of:

87.198.54.0 255.255.255.0 87.198.54.1 87.198.54.9 1

The route should have been:

87.198.54.9 255.255.255.255 87.198.54.1 87.198.54.9 1

I still wouldn't see a ping in the network monitor but a telnet connection does.

So this approach works e.g. for HTTP traffic when you're not using 127.0.0.1

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.