I have two applications a client and a server running on my local machine and want to monitor their network traffic through NetMon.

One solution is to route the local traffic through the default gateway. However, I never got this working. It should be as easy as adding the following route:

net add <localip> MASK <mask> <defaultgatway> METRIC 1 IF 1


Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric       25
--->       1       25       25
Default Gateway:

--->       1

So I would expect that this route routes everything to to the gateway. It doesn't.

The approach is described in the following Technet slides. So I am pretty sure there must be a way to make this work....


Any ideas why the route doesn't work?


I run a ping on local machine to my local machine.

How can I see the ICMP packets in MS NetMon?

Thanks, Alex


Monitoring local traffic on Windows is dodgy, at best. The method you're describing won't work for traffic bound for As far as I know, there's no simple way to get that traffic into any sniffer.

Assuming you're looking to capture a TCP-based protocol, I'd install a build of rinetd (Windows binary available at that link) on a remote computer with a configuration to listen on the appropriate port and send the traffic back to the listening program back on your machine. Then the traffic will be sent across the wire and you can catch it with NetMon.

I've used this "remote proxy back to the local machine" technique on many occasions to great success.

| improve this answer | |

The problem was in the route:

Instead of: 1

The route should have been: 1

I still wouldn't see a ping in the network monitor but a telnet connection does.

So this approach works e.g. for HTTP traffic when you're not using

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.