How can I capture traffic to localhost using Wireshark?

Question

I am using Wireshark on Windows Vista and I would like to capture http traffic to localhost (127.0.0.1), for debugging purposes, but I have some questions.

• How can I do this?
• What capture interface should I use?
  • If I use my NIC as capture interface, only packets to and from the internet are captured.
• Are there any settings in Wireshark to capture packets going to and from localhost?

Solution 1

The short answer is, on Windows you can't. The Wireshark Wiki describes a couple of workarounds, such as installing a virtual network card using the Microsoft Loopback Adapter, however the results are less than optimal. Their suggestion of setting up a new route will give you all of your data twice, and could put unnecessary load on your network if left enabled, but you should get the data.

Solution 2

If you capture on the local loopback interface (called lo0 on my machine), that will show you the traffic between localhost and itself. The loopback is where localhost traffic goes when it doesn't have to go through the NIC interface.

Comments

[Jonas]

Thanks, but I forgot to write that I'm using it on Windows. I have updated my question now.

[user3561203]

Oh okay. I've never actually tried Wireshark on Windows, only Linux and Mac OS X.