Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] localhost versus url

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 10 Mar 2011 19:36:29 +0100
Hi,

Well, the relationship with OSI layers is a bit awkward, but if you want to talk layers, you end up circumventing the Datalink and Physical Layers when going through the loopback. The Network Layer determines that the packet doesn't need to go to a physical network interface, but rigtht back into the network stack.

Thanks,
Jaap

On 03/10/2011 07:12 PM, Tony Anecito wrote:
Hi Jaap,

Many thanks that makes sense. I do have a router with a set of static ips
provided by my isp and one of the ips is registered with godaddy and is tied to
my own domain name and that was what I was using prior to using localhost. I did
notice on wireshark when using my domain I would see what you described.

I wonder what layers of the OSI 7 layer model is bypassed? I would think the
first three (1-3) would be bypassed?

Thanks,
-Tony



----- Original Message ----
From: Jaap Keuter<jaap.keuter@xxxxxxxxx>
To: Community support list for Wireshark<wireshark-users@xxxxxxxxxxxxx>
Sent: Thu, March 10, 2011 12:19:12 AM
Subject: Re: [Wireshark-users] localhost versus url

Hello Tony,

Assuming your domain name is resolved to your public IP address on the outside
of the firewall/NAT, your assumption is right.

When entering localhost in the URL, that's resolved to 127.0.0.1, your local
machines loopback interface. No Ethernet networking involved, so watching with
Wireshark won't show this traffic at all (unless capturing the on the loopback
interface on a !Windows machine).

When entering the FQDN in the URL, that's resolved to your outside address.
Browser traffic flows to that address first, then comes back to access the
Apache server. Now you'll see the traffic when you capture on the network
interface, once going out and once coming in.

In the circumstance that there's no NAT involved (so your outside address is
your interface address) you still end up with more delay that going through the
loopback interface. The extra DNS interactions, and probably additional safety
measures of your platform, take away a little time for every object retrieved.

Thanks,
Jaap

On 03/09/2011 11:11 PM, Tony Anecito wrote:
Hi All,

I was running some performance tests last week and noticed with the client app
running on the same server or apache web server machine the response time was
much better when using localhost in the url versus my domain name. I assumed
somehow the connection is bypassing my router and connecting to the apache
process directly. Is that so and if not what should I see on Wireshark if
anything? Or is even the tcp/ip stack short circuited?

Thanks,
-Tony