How can I capture traffic to localhost using Wireshark?

Question

I am using Wireshark on Windows Vista and I would like to capture http traffic to localhost (127.0.0.1), for debugging purposes, but I have some questions.

How can I do this?
What capture interface should I use?
- If I use my NIC as capture interface, only packets to and from the internet are captured.
Are there any settings in Wireshark to capture packets going to and from localhost?

score 7 · Accepted Answer · answered Jun 29 '10 at 22:31

7

The short answer is, on Windows you can't. The Wireshark Wiki describes a couple of workarounds, such as installing a virtual network card using the Microsoft Loopback Adapter, however the results are less than optimal. Their suggestion of setting up a new route will give you all of your data twice, and could put unnecessary load on your network if left enabled, but you should get the data.

answered Jun 29 '10 at 22:31

heavyd

62,847
18
155
177

This was true in 2010, but Wireshark has shipped with Npcap for a while now and can capture loopback traffic just fine. – Gerald Combs Jan 23 '23 at 17:39

score 3 · Answer 2 · answered Jan 16 '19 at 00:27

3

For anyone reading this in 2019 or later, Wireshark 3.0 ships with Npcap, which allows loopback capture.

answered Jan 16 '19 at 00:27

Gerald Combs

303
1
5

score 2 · Answer 3 · answered Jun 29 '10 at 22:24

2

If you capture on the local loopback interface (called lo0 on my machine), that will show you the traffic between localhost and itself. The loopback is where localhost traffic goes when it doesn't have to go through the NIC interface.

answered Jun 29 '10 at 22:24

Steve Nay

255
3
8

Thanks, but I forgot to write that I'm using it on Windows. I have updated my question now. – Jonas Jun 29 '10 at 22:27
Oh okay. I've never actually tried Wireshark on Windows, only Linux and Mac OS X. – Steve Nay Jun 29 '10 at 22:36

How can I capture traffic to localhost using Wireshark?

3 Answers3