Ethereal-users: Re: [Ethereal-users] sniff loopback

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Thu, 15 Feb 2001 00:28:47 -0800
On Thu, Feb 15, 2001 at 10:20:18AM +0200, Sandor.Hojtsy@xxxxxxxxx wrote:
> Is it possible with ethereal to catch IP packets sent by a machine to 
> it's own IP address?

It depends on the OS, and it depends on how the OS handles that.  For
example, on my home machine, running FreeBSD 3.4, if I ping my own IP
address - not 127.0.0.1, but one of the IP addresses for its Ethernet
card - the traffic shows up on the loopback device, *not* on the network
device, so I see them if I capture on "lo0", but not if I capture on
"fxp0".

They show up as loopback packets, *not* Ethernet packets, in the capture
(not surprising, as I'm capturing on the loopback device). 
Nevertheless, they have the IP address in question, not 127.0.0.1, in
the IP header.

I may try that on my Debian 2.2, Solaris 7, and NT 4.0 partitions to see
what happens there.