Windows packet sniffer that can capture loopback traffic? [closed]
What you should do is to run RawCap, which is a sniffer that can capture traffic to/from the loopback interface in Windows. Just start it with "RawCap.exe 127.0.0.1 loopback.pcap".
You can then open up loopback.pcap in Wireshark or NetworkMiner to look at the network traffic.
You can find RawCap here:http://www.netresec.com/?page=RawCap
Good Luck!
I second the Microsoft Network Monitor (though this link works better at the time of writing) suggestion from Thomas Owens. Also, this post suggests that to get the loopback address, try doing:
route add <Your Machine's IP> <Your Router's IP>
This takes locally-generated packets for the local interface and sends them off to your router... which sends them back.
NOTE: To get your machine back to normal operation, make sure you delete the route when you're finished using:
route delete <Your Machine's IP>
There is a page on the Wireshark wiki that addresses the problem. Short answer is, you can't do it on a Windows machine, but there might be some workarounds.