本地主机嗅探器（Windows 操作系统）

Sniffer for localhost (Windows OS)

提问by citn

I am looking for a sniffer that can work with the loopback address in Windows.

我正在寻找一个可以在 Windows 中使用环回地址的嗅探器。

So far, I found Microsoft Network Monitor which is a nice tool, but for localhost it's useless because on Windows, localhost packets don't pass through the regular network stack, so they're invisible to an ethernet sniffer like MS Network Monitor.

到目前为止，我发现 Microsoft Network Monitor 是一个不错的工具，但是对于 localhost 它没有用，因为在 Windows 上，localhost 数据包不通过常规网络堆栈，因此它们对于像 MS Network Monitor 这样的以太网嗅探器是不可见的。

How do you debug applications that send data in the loopback mechanism? Any good (open source) sniffers that can work with localhost?

您如何调试在环回机制中发送数据的应用程序？任何可以与本地主机一起使用的好的（开源）嗅探器？

UPDATE: If you have experience with a tool, it would be nice to have a short description for future reference

更新：如果您有使用工具的经验，最好有一个简短的描述以供将来参考

回答by Rafael Nobre

I was faced with this issue and got nowhere after a lot of research. Basically all available sniffers rely on the network driver stack, and Windows don't expose localhost calls through it.

我遇到了这个问题，经过大量研究后一无所获。基本上所有可用的嗅探器都依赖于网络驱动程序堆栈，Windows 不会通过它公开 localhost 调用。

What I ended up using was a tool called SocketSniffer, that peeks at Winsock's calls and monitor TCP, UDP socket connections. It helped me debug an application problem that only occurred in win 2k3.

我最终使用的是一个名为 SocketSniffer 的工具，它可以窥视 Winsock 的调用并监控 TCP、UDP 套接字连接。它帮助我调试了一个仅在 win 2k3 中出现的应用程序问题。

Its download site is at http://www.nirsoft.net/utils/socket_sniffer.html

其下载站点位于http://www.nirsoft.net/utils/socket_sniffer.html

Note that this no longer works in Windows 8. Microsoft Message Analyzeris now capable of sniffing loopback traffic out of the box. Official blog post here: http://blogs.msdn.com/b/winsdk/archive/2014/08/15/rejoice-we-can-now-capture-loopback-traffic.aspx

请注意，这在 Windows 8 中不再有效。Microsoft Message Analyzer现在能够嗅探开箱即用的环回流量。官方博客文章在这里：http: //blogs.msdn.com/b/winsdk/archive/2014/08/15/rejoice-we-can-now-capture-loopback-traffic.aspx

回答by Erik

There is a new tool available for Windows that can capture looback / localhost network traffic. It is called RawCap and is available here: http://www.netresec.com/?page=RawCap

有一个适用于 Windows 的新工具可以捕获回送/本地主机网络流量。它被称为 RawCap，可在此处获得：http: //www.netresec.com/?page=RawCap

Just start RawCap like this to sniff the loopback interface: RawCap.exe 127.0.0.1 localhost.pcap

像这样启动 RawCap 来嗅探环回接口： RawCap.exe 127.0.0.1 localhost.pcap

You can then open localhost.pcap in Wireshark or any other pcap analyzerto look at the capured traffic.

然后，您可以在 Wireshark 或任何其他pcap 分析器中打开 localhost.pcap以查看捕获的流量。

Btw. not only is RawCap able to sniff loopback traffic on Windows, it can also sniff your WiFi interface as well as PPP interfaces such as 3G/UMTS connections.

顺便提一句。RawCap 不仅能够在 Windows 上嗅探环回流量，它还可以嗅探您的 WiFi 接口以及 PPP 接口，例如 3G/UMTS 连接。

回答by Michael Gattuso

I believe you can do http://localhost./(note the period at the end) to force localhost packets through the regular network stack.

我相信您可以执行http://localhost./（注意末尾的句号）来强制 localhost 数据包通过常规网络堆栈。

This works for getting http to be recognized by a tool like fiddler - not sure about other protocols.

这适用于让像 fiddler 这样的工具识别 http - 不确定其他协议。

回答by Gholamreza Fathpour

I have had such a issue when I want to monitor traffic on localhost after setting up SelfSSL on it. After searching about other useful tools, I found fidllre somehow suitable for my issue you should try this Fiddler for Http and Https

当我想在 localhost 上设置 SelfSSL 后监控它的流量时，我遇到了这样的问题。在搜索了其他有用的工具后，我发现 fidllre 以某种方式适合我的问题，你应该试试这个Fiddler for Http 和 Https

Hope this help you!

希望这对你有帮助！

回答by psychoschlumpf

I would recommend Wireshark, it can attach to any network device and offers some nice utilities to analize the traffic, plus it is free software.

我会推荐 Wireshark，它可以连接到任何网络设备，并提供一些不错的实用程序来分析流量，而且它是免费软件。