Wireshark Tips: capturing local traffic on Windows-优快云博客

本文链接：https://blog.youkuaiyun.com/bluebridge/article/details/1863920

本文介绍如何在Windows系统上配置捕获同一台计算机上两个实体之间的本地流量。通过使用ipconfig/all获取IP和MAC地址，并利用route和arp命令更改本地路由规则，使Wireshark等工具能够捕获这些通常不发送到网络接口的数据包。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

The following post from the WinPcap user list gives details on how to configure
a Windows box to capture local traffic (i.e. traffic between two entities
running on the same machine).

    http://winpcap.cs.pu.edu.tw/pipermail/winpcap-users/2006-March/000803.html

I have used this in a few scenarios and the instructions seem to work in a
typical machine configuration.  I am SURE there are lots of people who can
benefit from this info, so I recommend it get added to the Windows-specific
section of the FAQ.

The instructions can be simplified to:

------------------------------
Get your {IP} and {MAC} addresses from the command:

ipconfig /all

Using those two bits of info, use the following two commands to change your
local routing rules to force packets "on to the wire" where Wireshark can sniff
them:

route add {IP} {IP}
arp -s {IP} {MAC}

For example:

c:/> ipconfig /all
Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : mydomain.com
   Description . . . . . . . . . . . : Some Network Controller
   Physical Address. . . . . . . . . : AA-15-CC-AA-BB-42
   Dhcp Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IP Address. . . . . . . . . . . . : 192.168.10.105
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   [...]

c:/> route add 192.168.10.105 192.168.10.105
c:/> arp -s 192.168.10.105 AA-15-CC-AA-BB-42