There is now a sniffer available for Windows that can sniff localhost / loopback traffic (i.e. to 127.0.0.1). The tool is called RawCap. RawCap is a command line sniffer that can capture network traffic to/from any interface on your computer that has an IP. It saves captured frames/packets to a pcap file that you can open with Wireshark or NetworkMiner. You can read more about RawCap on my blog: http://www.netresec.com/?page=Blog&month=2011-04&post=RawCap-sniffer-for-Windows-released Good luck!