Ask Your Question

Revision history [back]

Windows will "short-circuit" a packet that is destined for an IP address that is assigned to a local NIC and this bypasses the capture point in the network stack for the NIC you might have expected it to be sent through.

npcap provides a "pseudo loopback" NIC named "Adaptor for loopback traffic capture" that allows this local traffic to be captured.

The Wireshark UI allow capturing on multiple interfaces by Ctrl + Click on the interfaces of interest, similarly multiple interfaces can be selected in the capture options dialog.