Wireshark-users: Re: [Wireshark-users] how to capture the message on the loopback interface

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 17 Jun 2008 19:57:07 -0700

On Jun 15, 2008, at 6:57 PM, wnwk wrote:

first question:
how to capture the message on loopback message.


Run Linux, *BSD/Mac OS X, or Tru64 UN*X, and capture on the appropriate interface (lo, lo0, or whatever it's called). :-)

See the link Jaap posted for details on this, and for alternatives to that recommendation.

second question:
If i ping my own computer on my computer using actual ip not 127.0.0.1.
how can i capture this message.


Run Linux, *BSD/Mac OS X, or Tru64 UN*X. Those packets are routed internally by the networking code, so, *if* your system has a UN*X- style loopback interface (not all do; Windows doesn't, for example), they appear as traffic on the loopback interface.

third question:
can these messages mentioned by first and second question be capture by
other compute in the same lan

No. Those packets are not transmitted on any LAN interface, as Ethernet adapters (and possibly other adapters) don't read their own transmissions, so the packet has to be routed internally - and, since it's being routed internally to the only host that should see it, it's not transmitted on any other network interface.