Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a Telnet server and client on my Windows 7 computer. Meanwhile, I'm running Wireshark to try to sniff the telnet login. I have been unable to get Telnet to send any packets that can be captured on Wireshark. I'm capturing packets, but none of them are from the port 23 or Telnet filter.

I connected to Telnet on my computer by typing this into command prompt: telnet localhost Then I sign in with my login and password successfully.

Since I'm logging into Telnet on the same computer with the server running, can this be causing an issue with sending packets in telnet?

share|improve this question

When you connect back into your own machine like this, your network stack is smart enough to recognize it and loop the traffic back to itself internally without adding load to the network that other people could sniff. This optimization is called "using the loopback interface".

If you want to capture that traffic, you'll have to run the sniffer on the same machine and have it sniff on the loopback interface. Otherwise, you'd have to put your telnet client and server on separate machines, and make sure everything's connected to a dumb hub (not a switch) or to a manageable switch with port mirroring set up.

Edit: I just realized I wrote this answer from a Unix perspective, but you're running Windows. I don't know the Windows stack well enough to know for sure that my answer applies, so take it with a grain of salt. I'll leave this answer here in case it's useful to Mac/Linux/other unix-like OS users as well.

Edit 2: Here's some info from the WireShark people with lots of info about how Windows deals with loopback.

Here's a simple tool that should be able to capture loopback traffic on Windows and save it as a .pcap file, which you can later analyze with WireShark. It's called RawCap.

share|improve this answer
On Unixes – at least Linux – the loopback interface lo can be sniffed just like any other. But the answer is correct for Windows, which, AFAIK, does not allow capturing loopback packets at all. – grawity Jul 12 '13 at 22:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.