Ethereal-users: Re: [Ethereal-users] Capturing same-machine TCP packets on NT

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 8 Mar 2001 14:39:24 -0800 (PST)
> I am trying to use Ethereal 0.8.11 on NT 4.0 (or Windows 2000) to capture
> TCP packets where the client and the server are both on the same machine
> (i.e. the same machine that's running Ethereal). I start my server, start
> Ethereal capture (no filters), run my client, then stop the capture. There
> are lots of packets captured, but none that have both the source and
> destination on this machine.
> 
> Is there any way for Ethereal to capture such packets, or am I out of luck?

You're out of luck:

	http://netgroup-serv.polito.it/winpcap/misc/faq.htm

"Q-11: Does WinPcap support loopback devices? 

A: No. Only physical interfaces are supported."

WinPcap is the library and driver that Ethereal (and WinDump, and
Analyzer, and...) uses on Windows to capture packets; a packet from a
given machine to the same machine would go over a loopback device and,
as the WinPcap driver doesn't (and possibly *can't*) capture packets
getting looped back, Ethereal (and WinDump, and Analyzer, and...) can't
see that traffic.