Capture local packets using Wireshark 使用 wireshark 抓本地包

Chia-Te Kuan

已于 2024-09-03 16:13:49 修改

阅读量1w

点赞数 5

CC 4.0 BY-SA版权

分类专栏： http-flv 經驗談分析工具文章标签：测试工具网络

于 2021-10-28 16:56:34 首次发布

本文链接：https://blog.csdn.net/agathakuan/article/details/121018071

在Windows系统中，本地到本地的通信通常不会经过网卡，导致Wireshark无法捕获。本文介绍了通过安装Npcap与Wireshark配合，启用Loopback流量捕获的方法，避免了使用路由命令导致的系统效率下降和网络程序运行问题。只需在Wireshark安装过程中选择'Install Npcap'，并确保开启Legacy loopback支持和Npcap的WinPcap API兼容模式，就能在Wireshark中看到127.0.0.1到127.0.0.1的包。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一般而言 windows 系統本地到本地ip 的傳輸不會經過網卡，因此無法由 wireshark 捕捉解析，本文介紹 wireshark 同步安裝 Npcap方式，藉此loopback本地ip 到本地ip

本文不推薦網傳 route add mask 255.255.255.255 這個方法，因將大幅拖慢系統效率(所有本地到本地的包都要重新入網卡)，甚者導致 timeout而無法運行Network program

Generally, data transmission between local IPs on a Windows system does not go through the network card, making it impossible for Wireshark to capture and analyze. This article introduces the method of installing Npcap alongside Wireshark, enabling loopback from local IP to local IP.

This article does not recommend the widely circulated method of adding a route with the mask 255.255.255.255, as it significantly reduces system efficiency (all local-to-local packets have to be re-routed through the network card) and can even cause timeouts, making it impossible to run network programs.