Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Question

Is there a way to get wireshark to capture packets sent from/to localhost?

When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But from localhost to localhost does not register anything.

Answer 1

There's a WIKI Entry about exactly this issue on the wireshark homepage.

They also mention specifics about the loopback interface regarding Windows - you could be running just into that.

You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap.

Answer 2

In Wireshark you need to choose the lo0 interface... not En0 or En1.

Go to:

• Show the capture options
• Under "Interface" choose: lo0
• Capture and you'll see a bunch of 127.0.0.1 communication

Answer 3

you can use RawCap Application to capture loopback packets and save them in a pcap file ... and then you can open it using Wireshark

Answer 4

Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (http://nmap.org/), so please report any issues on Nmap's development list (http://seclists.org/nmap-dev/).

Answer 5

You want to run wireshark on the "lo" interface or on "any".

With tshark or tcpdump you can use the -i option:

# tcpdump -i any port http

(This is mostly applicable to Linux)