How Microsoft Network Monitor monitors local addresses (loopback)

I used to struggle for a while and thought that this software was faulty and could not monitor my own server.

The hook of the API such as the SPE can indeed be done.

 

Later, I finally figured out that Microsoft Network Monitor monitors the data of the underlying Nic,

The connection to the local 127.0.0.1 does not pass through the NIC, so it cannot be monitored.

 

The solution is to use the LAN address (192.168.1 ..). Of course, this is not the case because it still does not go through the NIC. Then force him to take the NIC and add a route entry to the gateway.

Route add <your_ip> mask route 255.255.255 <the_gateway>

In this way, the IP address of the Local Machine passes through the gateway, and then the gateway forwards data to the local machine, so that it can be monitored.

The command for deleting a route is: by default, the route is automatically deleted when it is shut down.

Route Delete <your_ip>