Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have build a simple TCP server which listens on port 9999, and it has IP address I have a TCP client which has the same IP address and connects to the server on the said port.

Now when I start up the server and open Wireshark with display filter tcp.port==9999 and start the client and send/receive a message nothing get displayed in the capture window in Wireshark...

What am I doing wrong here?

I'm using Windows 7.

share|improve this question
Are the client and server running on the same system? – HABO May 29 '13 at 12:10
yup they are both on the same sys – dakait May 30 '13 at 3:58
Wireshark can capture traffic that goes in and out of a system, but traffic that never leaves the box can be a problem. If you can separate the client and server, or force the network traffic to run through a gateway or router, then Wireshark should see it. – HABO May 30 '13 at 13:21
im gonna do that now... – dakait May 30 '13 at 22:21

Well, you can always (asuming you have a Linux box) tcpdump traffic. For example:

tcpdump -i eth0 net 'port 9999' -s 65535 -w dump.pcap

Assuming your interface is eth0 that you are listening on.

Start the client, send/receive messages, and then just open that dump.pcap file with Wireshark to see the communication.

share|improve this answer
+1 for the info but im using windows machine – dakait May 30 '13 at 3:59
Then you can use WinDump (which is tcpdump ported to Windows, so most of the options are the same, although finding the right interface for the -i flag is more effort) or Wireshark (which also works on various UN*Xes, as does tcpdump) or Microsoft Network Monitor or any of a number of other packet analyzers. – user164970 May 30 '13 at 5:47

Are you using the IP address to connect, or localhost / host name? In that case I guess it could resolve it to the internal IP address (like and the traffic would never be put on a physical interface, and thus not seen by Wireshark.

If the traffic was there, your filter seems like it should pick it up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.