Wireshark · Ethereal-users: Re: [Ethereal-users] localhost on Windows 2k

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, May 21, 2004 at 03:33:40PM -0400, François Zacharie wrote:
> I Have a question about win2k. When I start capture on my Winshit 2000, 
> Ethereal cannot see any packet going on my localhost (127.0.0.1)????
> Example: If do a ping from a other computer to my computer, I will see 
> the packet going but if I do the same ping directly on my machine (ping 
> 127.0.0.1) Ethereal cannot see any packet of the ping.
> 
> Do you have a idea of what append?

Yes - what happened is that you decided to run Ethereal on an operating
system that doesn't make it easy to see traffic being sent from the
machine to itself.  :-(

WinPcap doesn't support that - it has been claimed that the drivers used
by some other network analyzers support it, but, if they do, the WinPcap
developers might not know how they do that.

Linux, various OSes using BPF such as the BSDs (including OS X), and
Digital UNIX support capturing traffic from the machine to itself; you
have to capture on the loopback interface ("lo" or "lo0").  Some other
UN*Xes don't support it.