Ethereal-users: Re: [Ethereal-users] Capture packets on WinXP to primary local IP (not localhost
On Fri, Apr 23, 2004 at 10:12:50AM -0500, David Gibbs wrote:
> I know I can't capture the packets going to localhost ... but if my
> system has an IP of 192.168.1.10, can I capture the packets if the
> client establishes the connection to the server using that IP?
No, because those packets are really just going to localhost. Most if
not all Ethernet interfaces appear not to receive packets that they
themselves transmit (even in promiscuous mode), and the same might apply
to other LAN interfaces; point-to-point interfaces (and probably
telephoneoid interfaces such as ISDN-based or ATM-based interfaces)
don't receive them either. Therefore, if a packet is sent to a machine
from itself, it's wrapped around internally regardless of whether it's
going to 127.0.0.1 (or the IPv6 equivalent) or to one of the machine's
external IP addresses.
Unfortunately, this means you can capture that traffic only if you can
capture on a "loopback" interface, as per
http://www.ethereal.com/media.html
because that's what you have to capture on to see that traffic.
Windows is not one of the systems where you can do that, unfortunately.
