Wireshark-users: Re: [Wireshark-users] Capturing local traffic on Windows XP

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 15 Jun 2007 09:28:33 -0700

Marcos Israel Ibarra Arias wrote:

I need to capture the traffic of what in linux is the interface lo,
but in windows xp on window's ethereal there is not such intefarce to
capture and I can't find a way to capture the traffic from localhost.
Can someone help me with this?

There is no equivalent to the loopback interface on Windows; packets sent from the host to itself are looped back inside the TCP/IP stack, and are not put onto any network interface, and thus can't be captured.

The only way you'd be able to capture that traffic would be to install an OS that loops back traffic by "sending" it on a loopback interface, e.g. Linux or one of the free-software BSDs (but *NOT* Solaris, which has the same problem Windows does, so this isn't a UNIX-vs-Windows thing).