Ethereal-users: Re: [ethereal-users] Get shared libpcap

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Warren Young <tangent@xxxxxxxx>
Date: Thu, 28 Oct 1999 17:56:48 -0600
Carsten Zerbst wrote:
> 
> PS: Is there a posibility to sniff packets which use the loopback
> interface only, because client and server are running on the same
> machine?

If the "official" method doesn't work, you could use tcpdump to do what
you want and then use Ethereal to read the dump file.  The command line
I use is:

	tcpdump -s 1514 -w capfile -i lo

("lo" should be replaced with the name of the loopback interface on your
system if you're not using Linux.)

-s 1514 works on Ethernet, but may chop packets on the loopback
interface.  In fact, on my system, ifconfig says the MTU on the loopback
interface is just under 4000 bytes.  That probably means that -s 4000 is
a better idea.
-- 
= Warren Young, maintainer of the Winsock Programmer's FAQ at:
=     http://www.cyberport.com/~tangent/programming/winsock/
= 
= ICBM Address: 36.8274040 N, 108.0204086 W, alt. 1714m