Can't capture any telnet packets

Question

I'm running a Telnet server and client on my Windows 7 computer. Meanwhile, I'm running Wireshark to try to sniff the telnet login. I have been unable to get Telnet to send any packets that can be captured on Wireshark. I'm capturing packets, but none of them are from the port 23 or Telnet filter.

I connected to Telnet on my computer by typing this into command prompt: telnet localhost Then I sign in with my login and password successfully.

Since I'm logging into Telnet on the same computer with the server running, can this be causing an issue with sending packets in telnet?

Answer 1

When you connect back into your own machine like this, your network stack is smart enough to recognize it and loop the traffic back to itself internally without adding load to the network that other people could sniff. This optimization is called "using the loopback interface".

If you want to capture that traffic, you'll have to run the sniffer on the same machine and have it sniff on the loopback interface. Otherwise, you'd have to put your telnet client and server on separate machines, and make sure everything's connected to a dumb hub (not a switch) or to a manageable switch with port mirroring set up.

Edit: I just realized I wrote this answer from a Unix perspective, but you're running Windows. I don't know the Windows stack well enough to know for sure that my answer applies, so take it with a grain of salt. I'll leave this answer here in case it's useful to Mac/Linux/other unix-like OS users as well.

Edit 2: Here's some info from the WireShark people with lots of info about how Windows deals with loopback. http://wiki.wireshark.org/CaptureSetup/Loopback

Here's a simple tool that should be able to capture loopback traffic on Windows and save it as a .pcap file, which you can later analyze with WireShark. It's called RawCap. http://www.netresec.com/?page=Blog&month=2011-04&post=RawCap-sniffer-for-Windows-released