First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Capturing http traffic

Hi

I am developing a web page and need to check the traffic to and from the web page. Unfortunately, I cannot capture anything on my laptop with my capture filter host 192.168.1.181 and port 44302. 192.168.1.181 is my workstation's IP. The captures works fine, if I do this between 2 hosts on the same segment of the network.

Kind regards, Sam

Le Frog's avatar
1
Le Frog
asked 2021-10-04 07:43:25 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

If the web server and the client are on the same host (machine) then the connection will be "short-circuited" and not actually go out the NIC, instead it will be run over the loopback adaptor (127.0.0.1 or ::1).

The wiki page Loopback explains the issue, but is seriously out of date for Windows systems. With modern npcap installed you will always see an "Adaptor for loopback traffic capture" in the interfaces list and this can be used to capture the traffic you require. For other Os's there will already be a "lo" (or lo0) virtual interface.

If using Windows I do NOT recommend trying any of the other methods on that page (possibly excepting rawcap), they are obsolete and can cause issues in your networking systems.

grahamb's avatar
23.8k
grahamb
answered 2021-10-04 08:32:24 +0000
edit flag offensive 0 remove flag delete link

Comments

HI,

Thank you for your answer. Is it so, even when the URL is defined as 192.168.1.181:44302. I do not think that there will be a reverse lookup. Even a reverse lookup will return my hostname:

Server: RT-AC86U-1E78 Address: 192.168.1.1

Name: WIN11 Address: 192.168.1.181

MVH Sam

Le Frog's avatar Le Frog (2021-10-04 09:39:35 +0000) edit

It does for me on Win10 using Chrome as a client. Try capturing on the "Adaptor for loopback traffic capture".

grahamb's avatar grahamb (2021-10-04 09:49:20 +0000) edit

Thanks. I will.

Le Frog's avatar Le Frog (2021-10-04 11:41:43 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer