Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

There's a WIKI Entry about exactly this issue on the wireshark homepage.

They also mention specifics about the loopback interface regarding Windows - you could be running just into that.

You can't capture on the local loopback address 127.0.0.1 with a Windows packet capture driver like WinPcap.

In Wireshark you need to choose the lo0 interface... not En0 or En1.

Go to:

• Show the capture options
• Under "Interface" choose: lo0
• Capture and you'll see a bunch of 127.0.0.1 communication

you can use RawCap Application to capture loopback packets and save them in a pcap file ... and then you can open it using Wireshark

You want to run wireshark on the "lo" interface or on "any".

With tshark or tcpdump you can use the -i option:

# tcpdump -i any port http

(This is mostly applicable to Linux)