Capturing packets in a loopback interface

You can configure Wireshark to capture packets in localhost. Visit https://wiki.wireshark.org/CaptureSetup/Loopback to see how you can configure the loopback interface to capture packets in the 127.0.0.1 localhost interface.

If you are working with the Unix operating system, you can capture traffic directly with Wireshark. For more information, check out https://wiki.wireshark.org/CaptureSetup/Loopback.

If you are working with the Windows operating system, you may have problems capturing packets on localhost with Wireshark. At this point, the recommendation is to use a raw socket sniffer, such as RawCap (http://www.netresec.com/?page=RawCap), to capture localhost network traffic in Windows. You can read more about this at http://www.netresec.com/?page=Blog&month=2011-04&post=RawCap-sniffer-for-Windows-released.

The following is the execution of RawCap.exe on a windows system for capturing packets on the loopback interface. By default, it creates a dumpfile.pcap file with sniffed packets.

In the following screenshot, we can see the execution of RawCap.exe for getting machine interfaces:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset