Why tcp.dstport==8127 doesn't capture traffic

Question

I have a simple node.js server running on locahost:8127:

const http = require('http');

http.createServer(function (req, res) {
    console.log('incoming');
}).listen(8127);

Now I make requests from a browser to locahost:8127 and I want to capture all traffic between these two, so I've put the following display filter:

tcp.dstport==8127

But it doesn't show anything. Why?

I understand that additional details are required to answer the question, I'll provide, I just don't know what exactly is also required.

@GeraldSchneider, yeah, I'm using Ethernet. What do you mean by `loopback`? — Max Koretskyi, Jan 05 '17 at 07:26
You should really start reading the documentation. https://wiki.wireshark.org/CaptureSetup/Loopback — Gerald Schneider, Jan 05 '17 at 07:38
@GeraldSchneider, there's too much of it and I'm not event sure what to look for. Thanks for pointing at the right spot! — Max Koretskyi, Jan 05 '17 at 07:58
@GeraldSchneider, can you clarify please. The docs says _You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap._ - but can I capture it with [npcap](https://github.com/nmap/npcap/releases) installed? Or 127.0.0.1 can't be capured on Windows at all? — Max Koretskyi, Jan 05 '17 at 08:05
>`ask a lot, read a lot, ...` read more - it's the only way to be sure. — user9517, Jan 05 '17 at 08:51
@GeraldSchneider, can you post your comment as an answer? It guided me into the right direction. — Max Koretskyi, Jan 05 '17 at 09:24

score 2 · Accepted Answer · edited Apr 13 '17 at 12:14

From the documentation:

If you are trying to capture traffic from a machine to itself, that traffic will not be sent over a real network interface, even if it's being sent to an address on one of the machine's network adapters. This means that you will not see it if you are trying to capture on, for example, the interface device for the adapter to which the destination address is assigned. You will only see it if you capture on the "loopback interface", if there is such an interface and it is possible to capture on it

The screenshot on your previous question looks like you are on windows. So, this applies:

You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap. The following page from "Windows network services internals" explains why: The missing network loopback interface.

To get a loopback interface on Windows you have to use npcap, instead of the WinPcap driver that comes with WireShark for Windows.

npcap can be downloaded here: https://github.com/nmap/npcap/releases

Install it and select the loopback interface for your capture. See the linked documentation for details.

Sadly far too many people thing that `ServerFault is a web 2.0 "RTFMaaS"` :( — user9517, Jan 05 '17 at 09:37
@Hanginoninquietdesperation, I don't understand you sentiment. I have a problem, I come here, ask a question, get a guidance, go and read. — Max Koretskyi, Jan 05 '17 at 09:51
@Maximus http://serverfault.com/help/how-to-ask bullet point 2. You should attempt to help yourself first. You have amply demonstrated that you have not attempted that. Which is ironic really given what you say in your profile. So my sentiment - learn to read and help yourself rather than getting someone else to read for you as you don't learn anything the other person does. - Simples. — user9517, Jan 05 '17 at 10:13

Why tcp.dstport==8127 doesn't capture traffic

1 Answers1