Why tcp.dstport==8127 doesn’t capture traffic [closed]

by

I have a simple node.js server running on locahost:8127:

const http = require('http');

http.createServer(function (req, res) {
    console.log('incoming');
}).listen(8127);

Now I make requests from a browser to locahost:8127 and I want to capture all traffic between these two, so I’ve put the following display filter:

tcp.dstport==8127

But it doesn’t show anything. Why?

I understand that additional details are required to answer the question, I’ll provide, I just don’t know what exactly is also required.

Answer

From the documentation:

If you are trying to capture traffic from a machine to itself, that traffic will not be sent over a real network interface, even if it’s being sent to an address on one of the machine’s network adapters. This means that you will not see it if you are trying to capture on, for example, the interface device for the adapter to which the destination address is assigned. You will only see it if you capture on the “loopback interface”, if there is such an interface and it is possible to capture on it

The screenshot on your previous question looks like you are on windows. So, this applies:

You can’t capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap. The following page from “Windows network services internals” explains why: The missing network loopback interface.

To get a loopback interface on Windows you have to use npcap, instead of the WinPcap driver that comes with WireShark for Windows.

npcap can be downloaded here: https://github.com/nmap/npcap/releases

Install it and select the loopback interface for your capture. See the linked documentation for details.

Attribution
Source : Link , Question Author : Max Koretskyi , Answer Author : Community

Leave a Comment