I'm investigating an issue with a process that performs IPC via a socket. The socket is served on the local machine's NIC's IP, and the connection is made to the local machine's NIC's IP from another process on the local machine.
I expected that this would drop down the Windows networking stack at least far enough that Wireshark could see the packets. However, it appears that this is not the case. Therefore, I can conclude that socket IPC takes place higher in the stack [would be interesting to see if any windows event tracing (ETW) facilities would see the traffic as an IP frame]. This isn't important to this question (since this isn't stackoverflow).
Where does WinPcap/Npcap "live" in the networking stack to listen for and pass packets to wireshark?
I'm focused on modern Windows OS versions (client: 7+, 10+; server: 2008+, 2012+, 2016+). Specifically, this client is Windows 10.
I effectively want to know where in the network stack the decision is made to "loop back" the packets to the host instead of sending them down the stack.