Is there a way to get wireshark to capture packets sent from/to localhost?
When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But from localhost to localhost does not register anything.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this communityIs there a way to get wireshark to capture packets sent from/to localhost?
When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But from localhost to localhost does not register anything.
There's a WIKI Entry about exactly this issue on the wireshark homepage.
They also mention specifics about the loopback interface regarding Windows - you could be running just into that.
You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap.
In Wireshark you need to choose the lo0 interface... not En0 or En1.
Go to:
you can capture on the loopback interface on Linux, on various BSDs including Mac OS X, and on Digital/Tru64 UNIX, and you might be able to do it on Irix and AIX, but you definitely cannot do so on Solaris, HP-UX, or Windows.
– Allan Ruin
Mar 19 '14 at 6:43
you can use RawCap Application to capture loopback packets and save them in a pcap file ... and then you can open it using Wireshark
You want to run wireshark on the "lo" interface or on "any".
With tshark or tcpdump you can use the -i option:
# tcpdump -i any port http
(This is mostly applicable to Linux)
Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (http://nmap.org/), so please report any issues on Nmap's development list (http://seclists.org/nmap-dev/).