<p>(This is a followup to my <a href="https://stackoverflow.com/questions/42468/how-do-i-measure-bytes-inout-of-an-ip-port-used-for-net-remoting">previous question</a> about measuring .NET remoting traffic.)</p>

<p>When I am testing our Windows service / service controller GUI combination, it is often most convenient to run both pieces on my development box. With this setup, the remoting traffic between the two is via loopback, not through the Ethernet card.</p>

<p>Are there any software packet sniffers that can capture loopback traffic on a WinXP machine? <a href="http://www.wireshark.org/" rel="nofollow noreferrer">Wireshark</a> is a great package, but it can only capture external traffic on a Windows machine, not loopback.</p>

[{'answer_id': 46381, 'author': 'Thomas Owens', 'author_id': 572, 'author_profile': 'https://Stackoverflow.com/users/572', 'pm_score': 2, 'selected': False, 'text': '<p>I\'m not sure if it can or not, but have you looked at <a href="http://www.microsoft.com/downloads/details.aspx?familyid=18b1d59d-f4d8-4213-8d17-2f6dde7d7aac&amp;displaylang=en" rel="nofollow noreferrer">Microsoft Network Monitor</a>? It <em>might</em> be an option.</p>\n'}, {'answer_id': 46554, 'author': 'Eric Z Beard', 'author_id': 1219, 'author_profile': 'https://Stackoverflow.com/users/1219', 'pm_score': 3, 'selected': False, 'text': '<p>There is a <a href="http://wiki.wireshark.org/CaptureSetup/Loopback" rel="noreferrer">page</a> on the Wireshark wiki that addresses the problem.  Short answer is, you can\'t do it on a Windows machine, but there might be some workarounds.</p>\n'}, {'answer_id': 46963, 'author': 'SilverViper', 'author_id': 3228, 'author_profile': 'https://Stackoverflow.com/users/3228', 'pm_score': 2, 'selected': False, 'text': '<p>Did you try to install the MS Loopback Adapter and try sniffing on that adapter with you favorite sniffing application?</p>\n\n<p>Also if I remember correctluy NAI Sniffer <a href="http://www.sniffer.com" rel="nofollow noreferrer">link</a> did use to have loopback sniffing capabilities, but it\'s been a while I used either solution...</p>\n'}, {'answer_id': 1460752, 'author': 'andrecarlucci', 'author_id': 22693, 'author_profile': 'https://Stackoverflow.com/users/22693', 'pm_score': 2, 'selected': False, 'text': '<p>If you don\'t care to pay, try this: <a href="http://www.tamos.com/products/commview/" rel="nofollow noreferrer">CommView</a></p>\n\n<p>It seems to work, however the Evalution version doesn\'t display the\ncomplete packets.</p>\n'}, {'answer_id': 5610667, 'author': 'Erik', 'author_id': 700689, 'author_profile': 'https://Stackoverflow.com/users/700689', 'pm_score': 5, 'selected': False, 'text': '<p>What you should do is to run RawCap, which is a sniffer that can capture traffic to/from the loopback interface in Windows. Just start it with "RawCap.exe 127.0.0.1 loopback.pcap".</p>\n\n<p>You can then open up loopback.pcap in Wireshark or <a href="http://www.netresec.com/?page=NetworkMiner" rel="noreferrer">NetworkMiner</a> to look at the network traffic.</p>\n\n<p>You can find RawCap here:\n<a href="http://www.netresec.com/?page=RawCap" rel="noreferrer">http://www.netresec.com/?page=RawCap</a></p>\n\n<p>Good Luck!</p>\n'}, {'answer_id': 5738375, 'author': 'Peter K.', 'author_id': 12570, 'author_profile': 'https://Stackoverflow.com/users/12570', 'pm_score': 4, 'selected': False, 'text': '<p>I second the <a href="http://www.microsoft.com/downloads/en/details.aspx?FamilyID=983b941d-06cb-4658-b7f6-3088333d062f&amp;displaylang=en">Microsoft Network Monitor</a> (though this link works better at the time of writing) suggestion from Thomas Owens.  Also, <a href="http://social.technet.microsoft.com/Forums/en-US/netmon/thread/ec9bd062-b999-40c3-bec8-5a7e48d9bf6e">this post</a> suggests that to get the loopback address, try doing:</p>\n\n<p><strong>route add &lt;Your Machine\'s IP&gt; &lt;Your Router\'s IP&gt;</strong></p>\n\n<p>This takes locally-generated packets for the local interface and sends them off to your router... which sends them back.</p>\n\n<p><strong>NOTE:</strong>  To get your machine back to normal operation, make sure you delete the route when you\'re finished using:</p>\n\n<p><strong>route delete &lt;Your Machine\'s IP&gt;</strong> </p>\n'}, {'answer_id': 33655792, 'author': 'hsluoyz', 'author_id': 1087890, 'author_profile': 'https://Stackoverflow.com/users/1087890', 'pm_score': 0, 'selected': False, 'text': '<p>You should definitely try Npcap, it works perfectly with Wireshark to capture loopback traffic in Windows, see here:\n<a href="https://wiki.wireshark.org/CaptureSetup/Loopback" rel="nofollow">https://wiki.wireshark.org/CaptureSetup/Loopback</a></p>\n'}]
['https://Stackoverflow.com/questions/46376', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3776/']