Ethereal-users: Re: [Ethereal-users] Capture local packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 24 Mar 2003 11:15:28 -0800
On Mon, Mar 24, 2003 at 10:36:09AM +0100, Wenger Serge wrote:
> My problem is that I didn't see frames with the source and the destination
> is my PC (I use the real address not localhost).
> 
> How can I configure to see these messages:

Un-install Windows, and install Linux or one of the BSDs.

Few, if any, network interfaces receive packets that they themselves
transmit, so if a packet is being sent from a machine to itself, the
"transmission" is done by moving the packet around inside the networking
stack.  (This is the case regardless of whether you send the packet to a
real network address for the sending machine, or to
localhost/127.0.0.1.)

On some OSes, the packet is treated as being sent and received on a
"loopback" interface, and, on some of those OSes, you can capture
traffic on those loopback interfaces and see those packets.

However, on OSes that don't treat the packet as being sent and received
on a loopback interface, or on OSes that don't let you capture traffic
on a loopback interface, you can't see that traffic.

Windows is, as far as I know, an OS that doesn't treat the packet as
beign sent and received on a loopback interface, as there is no Windows
loopback interface similar to the loopback interfaces on most UNIX
systems.  (There is a Microsoft Loopback Adapter available for some
versions of Windows, but:

	1) it's not a standard part of Windows, so it's not the
	   mechanism Windows uses for looping packets back in, for
	   example, IPv4 or IPv6;

	2) even if it were, it appears you can't capture on it with
	   WinPcap.)