网络抓包工具抓取本地环回接口127.0.0.1的数据包

网络抓包工具抓取本地环回接口127.0.0.1的数据包

(2011-07-24 00:35:39)

转载▼

标签： it

1. 使用wireshark无法抓取本地环回接口127.0.0.1的数据包：

 

Windows TCP/IP stack does not implement a network loopbackinterface, as found in other TCP/IP stack like lo* interfaces inBSD systems.

Thus, it is not possible to sniff network traffic using the typicalWindows packet capture driver, WinPcap。

http://wiki.wireshark.org/CaptureSetup/Loopback

http://www.hsc.fr/ressources/articles/win_net_srv/missing_loopback.html

 

2. Rawcap工具可以实现抓取本地环回接口127.0.0.1的数据：

Sniffing tools like dumpcap, WinDump and NMCap can unfortunatelynot be used since no WinPcap or NDIS driver is installed. RawCapdoes, however, not need any special driver installed since it makesuse of the Raw Sockets functionality built into Windows.Pen-testers can therefore run RawCap.exe to sniff traffic withoutinstalling any drivers.

http://www.netresec.com/?page=RawCap