title: Does sniffing in loopback capture outside traffic?
body: <p>i have a game server running on some port.
      I learned to sniff packets on loopback. So if i connect to it from same computer, the packets are captured.</p>
  
  <p>But somebody can connect from other computer and the packet will not be sniffed.</p>
  
  <p>The packets from some computer must pass through one of my interfaces. So should i sniff on that interface too inorder to get packets coming from both my computer and other computers? </p>
  
  <p>Here is my program</p>
  
  <pre><code>#define IP_HL(ip)               (((ip)-&gt;ip_vhl) &amp; 0x0f)
  #define IP_V(ip)                (((ip)-&gt;ip_vhl) &gt;&gt; 4)
  #define _WINSOCK_DEPRECATED_NO_WARNINGS
  #include &lt;stdio.h&gt;
  #include &lt;pcap.h&gt;
  #include &lt;WS2tcpip.h&gt;
  #pragma comment(lib, "Ws2_32.lib")
  void
  got_packet(u_char* args, const struct pcap_pkthdr* header, const u_char* packet)
  {
      for (int i = 0; i &lt; (*header).len; i++)
      {
          printf("%d ", (unsigned char)packet[i]);
      }
      printf("\n");
      return;
  }
  int main(int argc, char* argv[])
  {
      char* dev, errbuf[PCAP_ERRBUF_SIZE];
      pcap_if_t* interfaces, * temp;
      pcap_if_t* loopback = NULL;
      int i= pcap_findalldevs(&amp;interfaces,errbuf);
      if (i == -1) {
          fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
          return(2);
      }
  
      for (temp = interfaces; temp; temp = temp-&gt;next)
      {
          printf("%d ", temp-&gt;flags);
          printf("Name: %s with ", temp-&gt;name);
  
          printf(" %s \n", temp-&gt;description);
          if (temp-&gt;flags % 2 == 1)
          {
              printf("Loopback device found\n");
              loopback = temp;
          }
      }
      if (loopback == NULL)
      {
          printf("No loopback device found.\n Install npcap from nmap.org/npcap / ");
          return 0;
      }
      struct bpf_program fp;      /* The compiled filter expression */
      pcap_t* handle;
      char filter_exp[] = "port 8192";    /* The filter expression */
      bpf_u_int32 net = NULL;     /* The IP of our sniffing device */
      struct pcap_pkthdr header;  /* The header that pcap gives us */
      const u_char* packet;       /* The actual packet */
      handle = pcap_open_live(loopback-&gt;name, BUFSIZ, 1, 5000, errbuf);
  
  
  
      if (handle == NULL) {
          fprintf(stderr, "Couldn't open device %s: %s\n", loopback-&gt;name, errbuf);
          return(2);
      }
      if (pcap_compile(handle, &amp;fp, filter_exp, 0, net) == -1) {
          fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
          return(2);
      }
      if (pcap_setfilter(handle, &amp;fp) == -1) {
          fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
          return(2);
      }
  
      pcap_loop(handle, -1, got_packet, NULL);
      pcap_close(handle);
      return(0);
  }
  </code></pre>