Wireshark loopback on mac os x

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP. enter image description here

Ricardo

Posted 2015-04-26T17:44:37.473

Reputation: 121

What did you expect to see? UDP calls for DNS? ARP? – Hennes – 2015-04-26T17:53:59.587

I want to see http traffic. – Ricardo – 2015-04-26T19:28:10.083

HTTP traffic usually uses TCP. If you want to see interpreted contents of the TCP packets (which might be HTTP request) then I suggest using webscarab or a similar proxy. Right now you are looking a layer to low. – Hennes – 2015-04-26T19:29:13.833

I'm not sure, but I think i saw http traffic in the past, and I expected just a wrong configuration, actually this issue only happens on loopback. – Ricardo – 2015-04-26T19:40:14.910

Answers

Presumably that's because no process on the machine is sending UDP packets to another endpoint on the same machine. Try doing ping 127.0.0.1 while you're capturing on lo0 and see whether ICMP packets show up (they do, at least on my Mountain Lion machine).

user164970

Posted 2015-04-26T17:44:37.473

Reputation:

ping to 127.0.0.1 shows ICMP packets in my wireshark – Ricardo – 2015-04-26T19:27:02.420

Then you're not seeing UDP packets because nobody's sending them over the loopback interface - as Hennes indicated, there's probably no reason for UDP traffic to show up there. If you're looking for HTTP traffic, that'll be TCP traffic. – None – 2015-04-27T01:26:18.000