标签: it |
1. 使用wireshark无法抓取本地环回接口127.0.0.1的数据包:
Windows TCP/IP stack does not implement a network loopback interface, as found in other TCP/IP stack like lo* interfaces in BSD systems.
Thus, it is not possible to sniff network traffic using the typical Windows packet capture driver, WinPcap。
http://wiki.wireshark.org/CaptureSetup/Loopback
http://www.hsc.fr/ressources/articles/win_net_srv/missing_loopback.html
2. Rawcap工具可以实现抓取本地环回接口127.0.0.1的数据:
Sniffing tools like dumpcap, WinDump and NMCap can unfortunately not be used since no WinPcap or NDIS driver is installed. RawCap does, however, not need any special driver installed since it makes use of the Raw Sockets functionality built into Windows. Pen-testers can therefore run RawCap.exe to sniff traffic without installing any drivers.