🔒 Locked

Capturing packets from localhost on a windows system

Started by Structural Jan 4, 2004 at 12:54 PM 8 replies 1.4k views

Original Post

Jan 4, 2004 at 12:54 PM

I''m debugging a network application on my windows machine, and because I don''t have a second machine handy, I need to go through the internal interface. However, my current network sniffer, Ethereal, is unable to capture anything from the internal interface as this is apparently a limitation from Windows. Are there any tools out there that will allow me to see what is going over the internal interface? It would really help me a lot. Thanks!

RandomTask

Jan 6, 2004 at 9:48 AM

Just to make sure... Can you target your sniffer to check 127.0.0.1? That is the localhost address.

RandomTask

Structural

Jan 6, 2004 at 1:52 PM

Nope, that''s the whole problem. Everything sent to the localhost address (127.0.0.1 as you mention) is not sent to a normally accessible network device in Windows. It''s handled internally, and can not be accessed through whatever API ordinary network sniffers use (I think, that''s what I read on the Ethereal forums).

evolutional

Jan 6, 2004 at 1:58 PM

What about targetting the address of your NIC?

evolutional

Jan 6, 2004 at 2:10 PM

Can you not hook the winsock dll API and intercept your desired packets?

Interim

May 14, 2004 at 9:57 AM

I haven''t found a packet capture utility or device that works on Windows Loopback. if there is one, let me know.

Also, Microsoft will automatically send a packet to the loopback if they see it for one of their local adapters. So you can''t target your local, non-loopback IP, it''ll still be send over the loopback adapter, so you won''t capture it.

Int.

Gizz

May 14, 2004 at 10:10 AM

Have you tried Packet Analyzer ?

http://www.javvin.com/packet.html

-- edit
sadly, I think it doesn't handle localhost ( I took the time to try it after posting )

[edited by - gizz on May 14, 2004 11:24:56 AM]

iliak

May 15, 2004 at 6:14 AM

Why not using your public ip (if you have one) instead of 127.0.0.1 if you have a direct conn to the net ?

- Iliak -

Gizz

May 18, 2004 at 10:09 AM

I was browsing the Packet Analyzer website today(http://www.javvin.com/packet.html) and I found out that the version PRO support local host. Since I only have the trial "normal" version I can't verify this info

-- Edit
Quote from website ...
Capture all packets transmitted over local host and LAN (Professional edition only )

Gizz

[edited by - gizz on May 18, 2004 11:10:06 AM]

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.