0

I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get listen to packets on the same machine, but I found one more adapter after installing Wireshark:

Ethernet adapter Npcap Loopback Adapter:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::dcd7:4c40:f29c:2512%12
   Autoconfiguration IPv4 Address. . : 169.254.37.18
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

I was expecting I could capture packets by using this interface, but it failed. I still don't see them? Is it possible to capture packets on this interface at all?

vico
  • 99
  • 1
  • 2

1 Answers1

1

Npcap, the driver used by Wireshark, is able to sniff loopback packets (transmissions between services on the same machine) by using the Windows Filtering Platform (WFP). After installation, Npcap's setup will create this adapter ("Npcap Loopback Adapter").

In Wireshark, your aree right: this adapter can be chosen to capture packets to localhost. You will see all loopback traffic just the same way as other non-loopback adapters.

Try it by typing in commands like “ping 127.0.0.1” (IPv4) or “ping ::1” (IPv6).

bjoster
  • 4,805
  • 5
  • 25
  • 33