Viewing the loopback interface on Solaris 10 (using snoop or another tool)

Solution 1:

The posts are correct, you cannot snoop loopback traffic on solaris. You can't tcpdump it, you can't wireshark it. You can't dtrace it. Many have tried.

OpenSolaris supports it (via the clearview project).

Solution 2:

I realize that this is an old thread, but in case someone stumbles across it, it is worth noting that this appears to now be possible in Solaris 11:

http://docs.oracle.com/cd/E23824_01/html/821-1453/gexkw.html#gexnc

There is now a '-I' option that allows snoop to work with IP-layer devices.

Solution 3:

I vaguely recall some problems with snoop on the loopback interface (something about snoop requiring a real piece of harware which is why you get that DLPI message -- there's no Data Link Provider Interface for loopback b/c it's a virtual device).

You may want to try Wireshark or plain-ol-tcpdump, but you might be out of luck Re: lo0. As an alternative you could connect one of your physical interfaces to a dead-end hub with nothing else & send your traffic over that interface.