none
网络抓包工具抓取本地环回接口127.0.0.1的数据包 RRS feed

  • 常规讨论

  • 1. 使用wireshark无法抓取本地环回接口127.0.0.1的数据包:

     

    Windows TCP/IP stack does not implement a network loopback interface, as found in other TCP/IP stack like lo* interfaces in BSD systems.

    Thus, it is not possible to sniff network traffic using the typical Windows packet capture driver, WinPcap。

    http://wiki.wireshark.org/CaptureSetup/Loopback

    http://www.hsc.fr/ressources/articles/win_net_srv/missing_loopback.html

     

    2. Rawcap工具可以实现抓取本地环回接口127.0.0.1的数据:

    Sniffing tools like dumpcap, WinDump and NMCap can unfortunately not be used since no WinPcap or NDIS driver is installed. RawCap does, however, not need any special driver installed since it makes use of the Raw Sockets functionality built into Windows. Pen-testers can therefore run RawCap.exe to sniff traffic without installing any drivers.

    http://www.netresec.com/?page=RawCap

    2011年7月23日 16:14

全部回复

  • 现在Nmap项目基于WinPcap推出的改进版本Npcap for Nmap已经可以直接抓Windows回环地址127.0.0.1的报文了,安装Npcap后会自动生成Npcap Loopback Adapter网卡,在Wireshark中选择此网卡即可抓包。Npcap的下载地址为:https://github.com/nmap/npcap
    2015年12月28日 14:46