Wireshark localhost traffic capture

Question

I wrote a simple server app in C which runs on localhost. How to capture localhost traffic using Wireshark?

Why this question got closed? – Sylvain Rodrigue Apr 14 '23 at 18:54 — Sylvain Rodrigue, Apr 14 '23 at 18:54

score 80 · Accepted Answer · edited Aug 09 '19 at 05:42

80

If you're using Windows ~~it's not possible~~ - read below. You can use the local address of your machine instead and then you'll be able to capture stuff. See CaptureSetup/Loopback.

Summary: you can capture on the loopback interface on Linux, on various BSDs including Mac OS X, and on Digital/Tru64 UNIX, and you might be able to do it on Irix and AIX, but you definitely cannot do so on Solaris, HP-UX....

Although the page mentions that this is not possible on Windows using Wireshark alone, you can actually record it using a workaround as mentioned in a different answer.

EDIT: Some 3 years later, this answer is no longer completely correct. The linked page contains instructions for capturing on the loopback interface.

edited Aug 09 '19 at 05:42

Richard Kiefer

1,814
2
23
42

answered May 01 '11 at 07:45

cnicutar

178,505
25
365
392

feuGene's answer actually does work. – GWLlosa Aug 23 '12 at 12:28
@GWLlosa Yup. *You can use the local address of your machine*. – cnicutar Aug 23 '12 at 12:30
7

I found it was not sufficient to simply put your own IP in wireshark instead of loopback; adding the route was necessary for it to work in my situation. – GWLlosa Aug 23 '12 at 12:58
1

Thanks. On OS X, the loopback interface is lo0. Choosing en1 or whatever your default is won't work, it seems. – sudo Apr 27 '14 at 02:41
For setting up the loopback adapter, I found this youtube video useful. https://www.youtube.com/watch?v=KsWICPPO_N8 – developer747 Jun 04 '15 at 23:24
Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (http://nmap.org/), so please report any issues on Nmap's development list (http://seclists.org/nmap-dev/). – hsluoyz Aug 25 '15 at 13:46
`OSX 10.10.5`, `Wireshark 2.2.6`: I chose `Loopback lo0` for the Capture, but when I used TCP sockets to send data between a client and server, the Wireshark window remained completely blank. I tried it several times--nothing. Then I typed tcp into the "Apply a display filter" textbox, and voila! Data appeared. On successive TCP transmissions, I didn't have to type anything for a filter. – 7stud May 19 '17 at 01:41

score 56 · Answer 2 · edited May 23 '17 at 12:26

56

For some reason, none of previous answers worked in my case, so I'll post something that did the trick. There is a little jewel called RawCap that can capture localhost traffic on Windows. Advantages:

only 17 kB!
no external libraries needed
extremely simple to use (just start it, choose the loopback interface and destination file and that's all)

After the traffic has been captured, you can open it and examine in Wireshark normally. The only disadvantage that I found is that you cannot set filters, i.e. you have to capture all localhost traffic which can be heavy. There is also one bug regarding Windows XP SP 3.

Few more advices:

Wireshark wiki

edited May 23 '17 at 12:26

Community

1
1

answered Jan 25 '13 at 15:59

Miljen Mikic

14,765
8
58
66

1

no setup required and was quite simple. – vibhu Mar 25 '17 at 12:17
And you can have Wireshark read RawCap's output instantly, giving you live capturing. See my answer for details. – Richard Kiefer May 07 '17 at 19:01

score 49 · Answer 3 · edited Jan 31 '19 at 17:39

49

On Windows platform, it is also possible to capture localhost traffic using Wireshark. What you need to do is to install the Microsoft loopback adapter, and then sniff on it.

edited Jan 31 '19 at 17:39

Yogu

9,165
5
37
58

answered Jan 14 '12 at 02:25

ciphor

8,018
11
53
70

ciphor, have you successfully done this? this is in direct contradiction to cnicutar's answer. – feuGene Mar 08 '12 at 12:50
yes, I've done it successfully. – ciphor Mar 08 '12 at 13:19
And how? Didn't get it working. – schlamar Oct 25 '12 at 06:21
19

I got this to work all the same on Win 7. Device Manager -> Add Legacy Hardware -> I'll pick -> Networking -> Microsoft -> Loopback adapter. Once it's installed, configure it with an IP address of your chosing. Then: **reinstall wireshark** so that it will reinstall the capture driver on the new interface - this must be performed any time you add new interfaces to windows, loopback or real. – antiduh Jul 02 '13 at 20:54
4

Followed @antiduh instructions on Win 7 and while I did see some netbios queries, I did not see HTTP traffic on localhost. – Carlos Rendon Jul 30 '14 at 23:19
For setting up the loopback adapter on Windows 7, I found this youtube video useful. https://www.youtube.com/watch?v=KsWICPPO_N8 – developer747 Jun 04 '15 at 23:24
This doesn't seem to work on windows 8 - can see the loopback adapter in wireshark, and it's IP functions as a loopback, but no traffic is logged. – jsalter Nov 05 '15 at 16:34
1

The [Wireshark Wiki](https://wiki.wireshark.org/CaptureSetup/Loopback) mentions issues with this adapter, e.g. "but it will not work on the 127.0.0.1 IP addresses; it will take its own IP address". – Richard Kiefer Feb 22 '17 at 09:10
Instead of reinstalling wireshark just restart the driver in command prompt **net stop npf && net start npf** – ZAB May 28 '18 at 18:55

score 26 · Answer 4 · answered Mar 08 '12 at 12:55

I haven't actually tried this, but this answer from the web sounds promising:

Wireshark can't actually capture local packets on windows XP due to the nature of the windows TCP stack. When packets are sent and received on the same machine they don't seem to cross the network boundary that wireshark monitors.

However there is a way around this, you can route the local traffic out via your network gateway (router) by setting up a (temporary) static route on your windows XP machine.

Say your XP IP address is 192.168.0.2 and your gateway (router) address is 192.168.0.1 you could run the following command from windows XP command line to force all local traffic out and back across the network boundary, so wireshark could then track the data (note that wireshark will report packets twice in this scenario, once when they leave your pc and once when they return).

route add 192.168.0.2 mask 255.255.255.255 192.168.0.1 metric 1

http://forums.whirlpool.net.au/archive/1037087, accessed just now.

I tried this, and found that it worked very well. – GWLlosa Aug 23 '12 at 12:27 — GWLlosa, Aug 23 '12 at 12:27
not work on win 7 32bit – vantrung -cuncon Oct 31 '13 at 06:07 — vantrung -cuncon, Oct 31 '13 at 06:07

score 12 · Answer 5 · edited Jun 20 '20 at 09:12

12

You can view loopback traffic live in Wireshark by having it read RawCap's output instantly. cmaynard describes this ingenious approach at the Wireshark forums. I will cite it here:

[...] if you want to view live traffic in Wireshark, you can still do it by running RawCap from one command-line and running Wireshark from another. Assuming you have cygwin's tail available, this could be accomplished using something like so:

cmd1: RawCap.exe -f 127.0.0.1 dumpfile.pcap

cmd2: tail -c +0 -f dumpfile.pcap | Wireshark.exe -k -i -

It requires cygwin's tail, and I could not find a way to do this with Windows' out-of-the-box tools. His approach works very fine for me and allows me to use all of Wiresharks filter capabilities on captured loopback traffic live.

edited Jun 20 '20 at 09:12

Community

1
1

answered May 07 '17 at 18:54

Richard Kiefer

1,814
2
23
42

3

For me the essential part was to start the second cmd command with some delay, otherwise Wireshark could not read the .pcap file. Presumably, because there needs to be some recorded traffic in it to start with. – Richard Kiefer May 07 '17 at 18:55
This should be accepted answer (it is enough to run cmd2 from git bash) – fider Dec 20 '18 at 13:27
4

**An update**: Netresec just announced today (Jan 30, 2020) a new version of RawCap that now supports writing to a pipe or to `stdout`. So as of today, the solution provided above can be simplified as follows, with no `tail` required: `RawCap.exe -q 127.0.0.1 - | Wireshark.exe -i - -k` You can read more about the new RawCap features on the RawCap Redux announcement page here: https://www.netresec.com/?page=Blog&month=2020-01&post=RawCap-Redux – Christopher Maynard Jan 30 '20 at 19:24

score 11 · Answer 6 · answered Aug 25 '15 at 13:08

11

Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (http://nmap.org/), so please report any issues on Nmap's development list (http://seclists.org/nmap-dev/).

answered Aug 25 '15 at 13:08

hsluoyz

2,739
5
35
59

Option #1 from the wireshark's documentation `Starting from Windows Vista: Npcap is an update of WinPcap using NDIS 6 Light-Weight Filter (LWF), done by Yang Luo for Nmap project during Google Summer of Code 2013 and 2015. Npcap has added many features compared to the legacy WinPcap.` – KCD Aug 29 '16 at 09:23
You can download the installer from here: https://nmap.org/npcap/ – Wayne Phipps Feb 07 '18 at 11:18
2

It is good to know that NPcap has some license limitations for use in business environments. – Jan Smrčina Apr 25 '18 at 10:11

score 9 · Answer 7 · answered Dec 21 '15 at 23:56

For Windows,

You cannot capture packets for Local Loopback in Wireshark however, you can use a very tiny but useful program called RawCap;

RawCap

Run RawCap on command prompt and select the Loopback Pseudo-Interface (127.0.0.1) then just write the name of the packet capture file (.pcap)

A simple demo is as below;

C:\Users\Levent\Desktop\rawcap>rawcap
Interfaces:
 0.     169.254.125.51  Local Area Connection* 12       Wireless80211
 1.     192.168.2.254   Wi-Fi   Wireless80211
 2.     169.254.214.165 Ethernet        Ethernet
 3.     192.168.56.1    VirtualBox Host-Only Network    Ethernet
 4.     127.0.0.1       Loopback Pseudo-Interface 1     Loopback
Select interface to sniff [default '0']: 4
Output path or filename [default 'dumpfile.pcap']: test.pcap
Sniffing IP : 127.0.0.1
File        : test.pcap
Packets     : 48^C

score 6 · Answer 8 · answered Mar 14 '14 at 20:50

You cannot capture loopback on Solaris, HP-UX, or Windows, however you can very easily work around this limitation by using a tool like RawCap.

RawCap can capture raw packets on any ip including 127.0.0.1 (localhost/loopback). Rawcap can also generate a pcap file. You can open and analyze the pcap file with Wireshark.

See here for full details on how to monitor localhost using RawCap and Wireshark.

score 3 · Answer 9 · answered Dec 01 '18 at 02:22

3

Yes, you can monitor the localhost traffic using the Npcap Loopback Adapter

answered Dec 01 '18 at 02:22

melwinalm

51
1
4

Wireshark localhost traffic capture

9 Answers9

Linked