Monitor loopback traffic (monitor MS TCP Loopback inteface traffic) with Microsoft Network Monitor 3.4 - possible?

Question

I've downloaded NM 3.4 from microsoft.com and it appears that the software doesn't capture traffic on MS TCP Loopback interface. When I ping 127.0.0.1 address, NM shows no packets flowing. I've tried both promiscuous / standard NIC mode with no luck. The only way I know so far to capture loopback traffic on Windows machines is to use RawCap.

I'm using Windows XP SP3.

Regards.

Solution 1

This is "impossible" with Windows because the Microsoft TCP/IP stack does not have a loopback interface like BSD systems do. In fact, you can't see traffic that is sent from one Windows PC to any IP address that is bound to a local NIC, even if they're non loopback addresses.

Having said the above, you can use a tool that utilizes raw sockets in Windows to capture any and all traffic that is being moved around in the PC. An example of such a tool would be RawCap. You would then save the capture that RawCap takes and import it into Network Monitor to examine.

Here are some references that should get you going in the right direction:

1. Ethereal's discussion on loopback interface traffic
2. StackOverflow question: Windows packet sniffer that can capture loopback traffic?

Solution 2

As of 2014 this is possible with Microsoft Message Analyzer (which replaced Network Monitor). Instructions for configuring loopback capture are in this blog post. Note that the download link in the blog post is broken, but the link above should work.

I was able to successfully capture loopback traffic using this tool on Windows 10.

Comments

[Codeguard]

There is no need to configure, even. Just click Loopback and unencrypted IPSEC on the start page.