3

I've downloaded NM 3.4 from microsoft.com and it appears that the software doesn't capture traffic on MS TCP Loopback interface. When I ping 127.0.0.1 address, NM shows no packets flowing. I've tried both promiscuous / standard NIC mode with no luck. The only way I know so far to capture loopback traffic on Windows machines is to use RawCap.

I'm using Windows XP SP3.

Regards.

colemik
  • 759
  • 1
  • 12
  • 24

4 Answers4

1

This is "impossible" with Windows because the Microsoft TCP/IP stack does not have a loopback interface like BSD systems do. In fact, you can't see traffic that is sent from one Windows PC to any IP address that is bound to a local NIC, even if they're non loopback addresses.

Having said the above, you can use a tool that utilizes raw sockets in Windows to capture any and all traffic that is being moved around in the PC. An example of such a tool would be RawCap. You would then save the capture that RawCap takes and import it into Network Monitor to examine.

Here are some references that should get you going in the right direction:

  1. Ethereal's discussion on loopback interface traffic
  2. StackOverflow question: Windows packet sniffer that can capture loopback traffic?
Community
  • 1
Wesley
  • 32,690
  • 9
  • 82
  • 117
1

As of 2014 this is possible with Microsoft Message Analyzer (which replaced Network Monitor). Instructions for configuring loopback capture are in this blog post. Note that the download link in the blog post is broken, but the link above should work.

I was able to successfully capture loopback traffic using this tool on Windows 10.

Andrew Cooper
  • 216
  • 2
  • 6
0

I don't think it's possible with packet capture tools since the packets never hit the interface. You have to use a proxy of some sort.

Jim B
  • 24,081
  • 4
  • 36
  • 60
0

Windows Resource Monitor appears capable of capturing local traffic. Under Network -> Processes with Network Activity Send and Receive local traffic between local processes shows up fine. I'm still wondering how this is possible. I think it's probably tracking read and write calls (like truss/strace on Unix/Linux).

CleanerCoder
  • 1
  • 1