On Jan 27, 2012, at 9:53 AM, <Tim.Poth@xxxxxxxxxxx> wrote:
>> On Jan 27, 2012, at 12:46 PM, Andrej van der Zee wrote:
>>
>> I was wondering if there is a way to prevent packets sent to a local IP address to be shortcut-ed in the kernel. I want them to show up in the tcpdump. How could I do this on Ubuntu?
>
> http://wiki.wireshark.org/CaptureSetup/Loopback
The relevant part of which is "you can capture on the loopback interface on Linux".
I.e., at least on Linux (and on *BSD and Mac OS X and some other OSes listed there), you *can* capture packets that are shortcutted in the kernel - capture on the loopback interface ("lo" on Linux, "lo0" on *BSD/Mac OS X and at least some of the other OSes).
