at 0.0.0.0) what exactly did you mean when you wrote Some servers can be configured to listen for new connections only on (a) particular IP address(es) if the machine they run at has several interfaces, but most of them listens on all of them (i.e. In newer versions of Windows, this can be changed by creating the virtual interface and sending such traffic to it, which is what npcap does the RawCap does another thing, it hooks to another place in the networking stack than the interfaces' NDIS slots for filters.Īnd in addition to IP addresses assigned to interfaces, there are also IP addresses with a special meaning, such as '0.0.0.0' which means 'any of my interfaces' IP addresses, and '127.0.0.x' which means 'myself'. If the networking stack of Windows finds out that the packet's destination IP address matches one of its network interfaces, it delivers the packet 'internally', bypassing any interface. In case of local traffic, a special virtual interface exists in unix-like operating system, but not necessarily on Windows.

The operating system (or, more precisely, its networking stack) chooses the interface through which to send the packet depending on the packet's address (IP address in this case) when sending a packet to an external system. With npcap, you do not 'capture on an IP address', you always capture on an interface. I feel the above needs some clarification.

Wireshark localhost port filter