6

Considering this for the local loopback connection: -

It is implemented entirely within the operating system's networking software and passes no packets to any network interface controller.

If two applications on the same machine communicate with TCP/IP using the loop back address 127.0.0.1, will other applications on that machine, such as Wireshark, be able to intercept the packets and view the data being sent between the applications?

TheDarkKnight
  • 195
  • 7

1 Answers1

6

As you say, when the communication happens on localhost, no packet whatsoever goes to the external network, so if capture happens, then it must happen on the machine itself.

There are two noteworthy points in that respect:

  • Capturing on localhost does not work on all OS. Notably, it does not work well on Windows (there are partial solutions), while it works on Linux.

  • Capturing requires some extensive access rights. People who can capture localhost traffic already have root or Administrator access on the machine, so they can also directly inspect the RAM of the involved process, and generally do what they want with the machine.

Thus security issues related to a localhost connection do not come from traffic capture. More usually, problems come from unprivileged applications on the same machine (running as another local user) which connect to the server. A security-aware local server will usually use getpeereid() (on Unix-like systems) to know who is connecting to it.

Tom Leek
  • 168,808
  • 28
  • 337
  • 475
  • I thought that was the case. Thanks for confirming this. – TheDarkKnight Oct 29 '13 at 14:20
  • 2
    You can also filter traffic based on user in iptables, and loopback is a filterable interface. Since you probably have a particular port and internal IP in mind, you can make positively sure that only the two peers who you want to communicate on, for example, 127.0.0.3:22, can do so, and drop all other packets. That way, the applications themselves need not verify each other. In fact, if you want to prevent a user from accessing ANY network resource besides a specific loopback ip + port, you can do that. TL;DR? Firewalls are awesome. – Parthian Shot Jul 15 '14 at 19:04