18

Is there a way to get wireshark to capture packets sent from/to localhost?

When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But from localhost to localhost does not register anything.

Improve this question
3
  • what platform? Windows? Mac? Linux?
    – Jeff Atwood
    Jun 9, 2009 at 22:51
  • 1
    Particularly on Windows
    – Brian R. Bondy
    Jun 9, 2009 at 22:55
  • Please try Npcap: github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (nmap.org), so please report any issues on Nmap's development list (seclists.org/nmap-dev).
    – hsluoyz
    Aug 25, 2015 at 13:50

5 Answers 5

Reset to default
23

There's a WIKI Entry about exactly this issue on the wireshark homepage.

They also mention specifics about the loopback interface regarding Windows - you could be running just into that.

You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap.

Improve this answer
6
  • Care to elaborate why this is getting voted down?
    – Martin M.
    Jun 9, 2009 at 22:48
  • I did not vote down but probably because even basic questions that have easily findable solutions are encouraged on this site and stackoverflow.com. The answer is good but the tone is not. Consider editing it and I think it will be voted up.
    – Brian R. Bondy
    Jun 9, 2009 at 22:53
  • I'm sorry I'm not a native english speaker (guess I'm not the only one). I'll try to think about that in the future.
    – Martin M.
    Jun 9, 2009 at 22:55
  • +1 for knowing and adding the link.
    – l0c0b0x
    Jun 9, 2009 at 23:00
  • 2
    Might want to add the quick quote "You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap." from the linked page to save us the suspense...
    – andersoj
    May 28, 2012 at 11:44
6

In Wireshark you need to choose the lo0 interface... not En0 or En1.

Go to:

  • Show the capture options
  • Under "Interface" choose: lo0
  • Capture and you'll see a bunch of 127.0.0.1 communication
Improve this answer
4
  • on windows, of course, i dont believe you can do that without somehow adding a loopback interface manually.
    – djangofan
    Apr 21, 2010 at 22:02
  • yes, the document said: you can capture on the loopback interface on Linux, on various BSDs including Mac OS X, and on Digital/Tru64 UNIX, and you might be able to do it on Irix and AIX, but you definitely cannot do so on Solaris, HP-UX, or Windows.
    – Allan Ruin
    Mar 19, 2014 at 6:43
  • On OSX yosemite this worked!
    – James111
    Oct 8, 2015 at 23:19
  • Yes, for most Linux.
    – Anton
    Apr 13 at 18:12
4

you can use RawCap Application to capture loopback packets and save them in a pcap file ... and then you can open it using Wireshark

Improve this answer
1

You want to run wireshark on the "lo" interface or on "any".

With tshark or tcpdump you can use the -i option:

# tcpdump -i any port http

(This is mostly applicable to Linux)

Improve this answer
1

Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (http://nmap.org/), so please report any issues on Nmap's development list (http://seclists.org/nmap-dev/).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.