Use Wireshark to capture loopback traffic without a loopback adapter (转)

Use Wireshark to capture loopback traffic without a loopback adapter

If you’ve ever used Wireshark for debugging applications you may have noticed that it only seems to pick up traffic that is actually transmitted over the wire and ignores all traffic sent to your local ip address or localhost. If you want to watch this traffic without having to install a special loopback adapter you can use the following trick.

How to force local traffic to your default gateway
1) Open a command prompt (Run as Administrator for Vista/7)
2) Type ipconfig/all (note your local ip address(es) and default gateway)
3) Type “route add <your ip address> mask 255.255.255.255 <default gateway IP address> metric 1″

This instructs windows to send any requests for your local ip address to your default gateway, which will in turn forward the request back to your machine. Be aware that this route will disappear once you restart your machine unless you include the -p switch after the route command. You may also notice an echo effect if you’re using Wireshark because you see each request and response twice. You can remove this problem by applying the following filter at the top.

ip.src==<default gateway> or ip.dst==<default gateway>

Consider the default gateway as a client trying to reach your machine and all traffic sent to the default gateway as your machine’s response.

To remove the route, type “route delete <the ip address you entered>”.

If you have an application running locally that uses localhost, you can map localhost to the IP address you added a route for. Just don’t forget you mapped localhost to a different IP than 127.0.0.1!

How to map localhost
1) Open notepad (Run as Administrator in Vista/7)
2) Navigate to C:\Windows\System32\drivers\etc\ and open the hosts file (there’s no extension).
3) Add this entry “<the IP address you added a route for> localhost”. Note that the space between the ip address and localhost is a tab.

Now, when your machine tries to send something to localhost, it will resolve to the IP address you added a route for and send its traffic to your default gateway.

(Important!) Remember to unblock the port used for incoming traffic on your machine. Also, if you find that an application you’re using doesn’t seem to send out traffic the way you expect, try flushing the dns cache with ipconfig/flushdns.

转自:http://blog.sina.com.cn/s/blog_53d3653e0100t2kq.html

时间: 2024-11-11 22:17:09

Use Wireshark to capture loopback traffic without a loopback adapter (转)的相关文章

WireShark Flow capture analysis

Wiresharkl流量分析 1.图示是对WiFi数据接口的80号端口进行数据捕获,设置混杂模式 过滤表达式设置: IP地址设置过滤   ip.src==191.168.1.102    ip.dst==192.168.1.102   端口号过滤tcp.port==80    只显示TCP源端口的  txp.srcport==80 HTTP模式过滤   http.request.method="GET" Frame 物理层数据    Etherent数据链路层以太网帧    Inter

wireshark, loopback

Windows下传统的抓包工具如Wireshark/Ethereal不能对本地程序之间的网络通信抓包,如果即想要对本地通信进行抓包可如下设置. http://wiki.wireshark.org/CaptureSetup/Loopback详细介绍了如何操作但比较麻烦,其实只要最后一步就可以实现了: 在命令行提示下面输入: route add 192.168.10.10 mask 255.255.255.255 192.168.10.1 metric 1 就这么简单!其中192.168.10.10

How To: Capture Android &amp; iOS Traffic with Fiddler

How To: Capture iOS Traffic with Fiddlerhttps://www.telerik.com/blogs/how-to-capture-ios-traffic-with-fiddler?utm_medium=email&utm_source=eloqua&utm_campaign=fiddler-awareness-nurture&elqTrackId=649AA6BE931C88A025857FB5CA28063F&elq=ace69fc

Ubuntu下用wireshark抓取802.11封包并进行过滤分析

要用wireshark抓802.11的包 需要在linux下进行. 要在linux下抓802.11的包 需要在linux下安装无线网卡驱动. 所以 在正式抓取之前先把这两样东西搞起来. *没有特殊说明,均使用root权限 sudo su* 一 安装无线网卡驱动 无线网卡:DWA-160 USB无线网卡 网卡驱动:http://alris1.dlinkddns.com/download/dlink/DWA-160/DWA-160_B2_DPO_RT5572_LinuxSTA_2.6.1.3_201

Wireshark Hands-on Assignmen

Wireshark Hands-on Assignment2Familiar with Wireshark User InterfaceThe startup screen of Wireshark looks like the following.When Wireshark begins capturing packets, the screen looks like the following.Network interfaces installed on this computer.Yo

一站式学习Wireshark(八):应用Wireshark过滤条件抓取特定数据流

应用抓包过滤,选择Capture | Options,扩展窗口查看到Capture Filter栏.双击选定的接口,如下图所示,弹出Edit Interface Settints窗口. 下图显示了Edit Interface Settings窗口,这里可以设置抓包过滤条件.如果你确知抓包过滤条件的语法,直接在Capture Filter区域输入.在输入错误时,Wireshark通过红色背景区域表明无法处理过滤条件.最有可能的情况是,过滤条件中含有输入错误,或是使用了display filter的

用 Wireshark 图解:TCP 三次握手

摘要: 原创出处:www.bysocket.com 泥瓦匠BYSocket 希望转载,保留摘要,谢谢! “snow warn throughout the winter” 一.什么是 Wireshark ?简单地说,Wireshark 是抓包工具.官网说,“Wireshark 是一个网络包分析工具. 网络数据包分析仪将尝试捕获网络数据包并试图尽可能详尽显示该数据包.” 推荐一本书<Wireshark 网络分析就这么简单>,Wireshark 工具下载地址 https://www.wiresha

WirShark系列: 使用WireShark过滤条件抓取特定数据流(zz)

应用抓包过滤,选择Capture | Options,扩展窗口查看到Capture Filter栏.双击选定的接口,如下图所示,弹出Edit Interface Settints窗口. 下图显示了Edit Interface Settings窗口,这里可以设置抓包过滤条件.如果你确知抓包过滤条件的语法,直接在Capture Filter区域输入.在输入错误时,Wireshark通过红色背景区域表明无法处理过滤条件.最有可能的情况是,过滤条件中含有输入错误,或是使用了display filter的

Android利用tcpdump和wireshark抓取网络数据包

主要介绍如何利用tcpdump抓取andorid手机上网络数据请求,利用Wireshark可以清晰的查看到网络请求的各个过程包括三次握手,但相对来说使用Fiddler进行网络数据抓包和展现更方便,优点包括: (1)无需root (2)对Android和Iphone同样适用 (3)操作更简单方便(第一次安装配置,第二次只需设置代理即可) (4)数据包的查看更清晰易懂 (5) 可以查看https请求,建议使用Fillder,具体可见:利用Fiddler进行网络数据抓包. 1.下载并安装tcpdump