 | 1 | initial version |
If the web server and the client are on the same host (machine) then the connection will be "short-circuited" and not actually go out the NIC, instead it will be run over the loopback adaptor (127.0.0.1 or ::1).
The wiki page Loopback explains the issue, but is seriously out of date for Windows systems. With modern npcap installed you will always see an "Adaptor for loopback traffic capture" in the interfaces list and this can be used to capture the traffic you require. For other Os's there will already be a "lo" (or lo0) virtual interface.
If using Windows I do NOT recommend trying any of the other methods on that page (possibly excepting rawcap), they are obsolete and can cause issues in your networking systems.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
