Using WireShark to check WCF TCP Server and Client traffic on localhost

Question

I've created a simple TCP client and TCP server in Visual Studio using WCF. I have one simple operation on the server that receives an integer, increments it and sends it back. It works as expected.

I would like to use Wireshark to monitor traffic between the client and server running on localhost. Apparently this is not possible with the Wireshark standard install on Windows, as it cannot monitor the loopback adapter. There is a library called Npcap that is intended to solve this problem, so I have installed this:

Npcap on GitHub

When I run Wireshark, and select capture of the

Npcap Loopback Adapter

I do not see any TCP traffic (some UDP and DHCP only). I'm wondering what I would expect to see?

The C# code for the server is here (I've created it programmatically so that you can see all the details, there's nothing configured in App.Config)

using System;
using System.ServiceModel;
using System.ServiceModel.Description;

namespace TcpServer
{
    // Defining the service
    [ServiceContract]
    public interface ITcpService
    {
        [OperationContract]
        int GetNumber(int num);
    }

    // Implementing the service
    public class TcpService : ITcpService
    {
        public int GetNumber(int num)
        {
            return num + 1;
        }
    }

    class TcpServerConsole
    {
        static void Main(string[] args)
        {
            ServiceHost host;

            // Attempt to open the service
            try
            {
                // Create the service host with a Uri address and service description
                host = new ServiceHost(typeof(TcpService), new Uri("net.tcp://127.0.0.1:9000/MyService"));

                // Create the metadata that describes our service, add it to the service host
                var metadataBehavior = new ServiceMetadataBehavior() { HttpGetEnabled = false };
                host.Description.Behaviors.Add(metadataBehavior);

                // Add a tcp endpoint for our service, using tcp
                host.AddServiceEndpoint(typeof(ITcpService), new NetTcpBinding(), "");

                // Add the meta data service endpoint for describing the service
                var mexBinding = MetadataExchangeBindings.CreateMexTcpBinding();
                host.AddServiceEndpoint(typeof(IMetadataExchange), mexBinding, "net.tcp://127.0.0.1:9000/MyService/mex");

                // Open our service 
                host.Open();
            }
            catch (Exception e)
            {
                // Catch any problem with creating the service and report
                Console.WriteLine("Failed to open the server: {0}", e.Message);
                Console.WriteLine("Press [Return] to close");
                Console.ReadKey(true);
                return;
            }

            // Halt the program to keep the service open
            Console.WriteLine("Press [Return] to close server");
            Console.ReadKey(true);
            host.Close();
        }
    }
}

Answer 1

I'm the author of Npcap. First thanks for the report!

First I would like to mention that, the best way to get help about Npcap is using the mailing list: [email protected] or firing a issue at https://github.com/nmap/nmap/issues. I check those places every day. I mostly use Stackoverflow for asking questions, but doesn't search and answer questions about Npcap that much.

I'm not an expert in C#. I have created a WCF Service Application project in my VS2015. Copied your code to my Service1.svc.cs. Build it into WcfService1.dll. But I don't know how to use it?

Would you mind providing all your server and client code (including solution files)? So I can just use them to test Npcap (no need to grab the knowledge about C# and WCF). You can zip the code and attach the zip in the mail to [email protected]. I will reply it. Thanks!