RawCap and Wireshark: How to capture and analyze local traffic from host machine to itself

Wireshark is an incredible resource when it comes to capturing and analyzing network packets or traffic. 

Unfortunately, on Windows, Wireshark is unable to capture packets or traffic sent from a host machine to that same host machine. This is due to the fact that such local traffic is not sent over a real network interface, but instead (in many cases) is sent over a “loopback interface”. Loopback traffic can be captured on a variety of operating systems including Linux, BSD (including MacOS), however loopback traffic cannot be captured on Windows, Solaris, and HP-UX. 

In this post we will address how to capture local traffic on Windows and how to analyze that traffic using Wireshark.

Before we get started, it’s worthwhile to point out that Wireshark uses libpcap to capture live network data. libpcap is a library present on most modern UN*X platforms. 

On Windows, Wireshark uses WinPcap which is a version of libpcap for Windows. WinPcap is not present in vanilla Windows installations, but fear not, the Wireshark installation simplifies this by prompting to also install WinPcap. 

Packet capture tools like Wireshark also typically allow you to save packet capture data to a file. These files have general have the extension .pcap, although .cap and .dmp are also common extensions.

The reason Wireshark cannot capture loopback traffic on Windows, is in part due to the fact that Winpcap relies on the network driver stack. On Windows, this stack does not expose localhost calls.

So, What do we do?

We can use a raw packet analyzer, for example RawCap. RawCap can sniff any interface that has an IP address, including 127.0.0.1 (localhost/loopback). RawCap also enables you to save captured traffic as .pcap file! This means we can still use Wireshark to analyze our captures! Awesome!!

Using RawCap is easy simply execute C:\> RawCap.exe

DONE...We can then analyze the pcap file using Wireshark:




123

123

Port forwarding illustration

Before you understand what is port forwarding, you need at least basic understandings for below concept:

#1 IP addressing

#2 What is switch and router

#3 Inside network and outside network

Basically when you sign up a Home Internet plan with your service provider, you are provided with a router a.k.a router or gateway.

This device connects you to the Internet. You can either connect yourself to the router using LAN cable or WIFI method.

Everything works fine until you want to access your Home IP Camera remotely. You may be at office or travelling at foreign country. For example, you can still accessing to the IP Camera as long as you have internet connection, 4G or broadband connection.

Be default, due to the security, the router will not allow you to access inside network when you are at outside network. You can only access Internet (outside) when you are at home (inside) OR you want to access the IP Camera (inside) when you are at Home (inside).

To overcome this problem, you need to configure Port Forwarding in the router.

Below is a detailed diagram that shows the overall progress when you want to access the IP Camera via the Port Forwarding method.

Copyrights Axis