Why is my network traffic visible on loopback interface but not Ethernet in Wireshark capture?
I'm working on a project to capture simulated IoT devices' data using Node-RED and a Mosquitto MQTT broker. Here's my setup:
Tools: Node-RED, Mosquitto, Wireshark for packet capturing. Machine: Windows 11 Home (non-internet zone). Network: A 3Com model 3CDSG8 switch with no VLAN configuration. IP Configuration: Everything is configured on my machine's IP, and the IoT device data is working as expected. Firewall: Disabled on my machine.
The problem I’m facing is:
When I capture traffic on the Ethernet interface using Wireshark, MQTT protocol data is not visible. However, when I capture traffic on the loopback adapter interface, I can see the MQTT data. Since I’ve configured everything to communicate over the machine’s IP (not the loopback address), I would expect to see the MQTT traffic on the Ethernet interface, not just on loopback.
My questions are: Why is MQTT traffic not visible on the Ethernet interface in Wireshark, but visible on the loopback adapter? Is there any configuration I’m missing in my switch (3Com model 3CDSG8) or Node-RED/Mosquitto setup that would affect this? Are there any additional steps to ensure that traffic is routed correctly and captured over Ethernet? Any insights or suggestions would be highly appreciated! Thanks in advance.
Is it supposed to communicate to the outside world (Ethernet interface) in plain text? Or is it encrypted (using TLS)? In that case, you need to decrypt before the MQTT becomes visible.
An MQTT broker is a server that receives all messages from the clients and then routes the messages to the appropriate destination clients. Do you have client communication over localhost to the broker?
my broker file:
listener 1883 <machine-ip> #bind_interface Ethernet allow_anonymous true persistence true persistence_location C:/Program Files/mosquitto/data/ log_dest file C:/Program Files/mosquitto/logs/broker1.log log_type all log_timestamp trueand connected this broker to node-red and checked log data is being published on the time interval set