Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two applications a client and a server running on my local machine and want to monitor their network traffic through NetMon.

One solution is to route the local traffic through the default gateway. However, I never got this working. It should be as easy as adding the following route:

net add <localip> MASK <mask> <defaultgatway> METRIC 1 IF 1


Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric       25
--->       1       25       25
Default Gateway:

--->       1

So I would expect that this route routes everything to to the gateway. It doesn't.

The approach is described in the following Technet slides. So I am pretty sure there must be a way to make this work....

Any ideas why the route doesn't work?


I run a ping on local machine to my local machine.

How can I see the ICMP packets in MS NetMon?

Thanks, Alex

share|improve this question
up vote 1 down vote accepted

Monitoring local traffic on Windows is dodgy, at best. The method you're describing won't work for traffic bound for As far as I know, there's no simple way to get that traffic into any sniffer.

Assuming you're looking to capture a TCP-based protocol, I'd install a build of rinetd (Windows binary available at that link) on a remote computer with a configuration to listen on the appropriate port and send the traffic back to the listening program back on your machine. Then the traffic will be sent across the wire and you can catch it with NetMon.

I've used this "remote proxy back to the local machine" technique on many occasions to great success.

share|improve this answer
Thanks for the link to Wireshark! – Alex Dec 6 '09 at 23:52

The problem was in the route:

Instead of: 1

The route should have been: 1

I still wouldn't see a ping in the network monitor but a telnet connection does.

So this approach works e.g. for HTTP traffic when you're not using

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.