Wireshark loopback on mac os x

macos http wireshark

10,771

Presumably that's because no process on the machine is sending UDP packets to another endpoint on the same machine. Try doing ping 127.0.0.1 while you're capturing on lo0 and see whether ICMP packets show up (they do, at least on my Mountain Lion machine).

10,771

Author by

Ricardo

Ricardo :)

Updated on September 18, 2022

Comments

Ricardo over 1 year

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
- ganesh about 9 years
  
  What did you expect to see? UDP calls for DNS? ARP?
- Ricardo about 9 years
  
  I want to see http traffic.
- ganesh about 9 years
  
  HTTP traffic usually uses TCP. If you want to see interpreted contents of the TCP packets (which might be HTTP request) then I suggest using webscarab or a similar proxy. Right now you are looking a layer to low.
- Ricardo about 9 years
  
  I'm not sure, but I think i saw http traffic in the past, and I expected just a wrong configuration, actually this issue only happens on loopback.
Ricardo about 9 years

ping to 127.0.0.1 shows ICMP packets in my wireshark
Admin about 9 years

Then you're not seeing UDP packets because nobody's sending them over the loopback interface - as Hennes indicated, there's probably no reason for UDP traffic to show up there. If you're looking for HTTP traffic, that'll be TCP traffic.