I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs using the loopback interface), which is

When I run Wireshark on the server, I do not see any of the traffic going between the three applications. I added a route to the server to forward traffic destined for to my LAN's gateway, in which case I now see SYN packets for the traffic. However, I don't see anything come back.

Bottom line is... has anyone had success capturing local traffic on a Windows Server 2008 R2 machine?


It's explained here why it's not possible on the Wireshark wiki, together with some workarounds. Basically traffic local to the host is routed within the Windows TCP stack so never makes it to the interface layer which is where Wireshark listens (via winpcap). So without the workarounds behind that link, no it's not possible.


you minght try netmon which is microsoft's network monitor. It appears to add itself as a network service, so it might work.

  • Thanks for the suggestion Jim, but netmon did not work for capturing local traffic. – Bryan Dec 16 '11 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.