Can traffic on loopback be packet sniffed?

Question

Can any data exchanged on a local machine using the loopback IP 127.0.0.1 (localhost) be packet sniffed if the PC is also connected to a network (wireless or landline)?

Would like to know if the loopback, as a means of interprocess communication for locally running processes, can be regarded as a secure means of exchanging data (i.e., not privy to ease-dropping by anyone that resides externally on the network with a packet sniffer program).

This question is being asked in respect to all the pertinent OS platforms:

• Win2K/WinXP
• Vista
• Windows 7
• Mac OS X
• Linux

Answer 1

It should be safe from packet sniffing off the network because the traffic never goes on the wire (or airwaves).

A process on that local machine could sniff the packets tho.

Answer 2

The loopback interface can be regarded as secure with respect to the external network. It isn't secure within the same host.

Answer 3

I'm pretty sure that popular packet sniffers can't sniff the loopback interface (a cause of much grief and annoyance when debugging stuff on localhost).

Answer 4

The answers so far are correct, but I will phrase it a different way. It is possible to sniff the loopback adapter communications on the localhost itself, but it usually requires special drivers depending on the operating system. Loopback communications is safe from external sniffers though.

I have had cases where I needed to sniff loopback communications and it was not easy to setup, but it was possible (at least on Windows and I would bet so with Linux as well).

Answer 5

Yes, this is secure. As VBNight stated, the traffic never hits the wire or air.

But, you can actually sniff localhost traffic on your local machine. For example on my linux box I did the following:

sudo tcpdump -i lo

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 96 bytes
15:29:58.056585 IP localhost.56010 > localhost.16001: S 3572335637:3572335637(0) win 32792 <mss 16396,sackOK,timestamp 132126218 0,nop,wscale 6>
15:29:58.056604 IP localhost.16001 > localhost.56010: R 0:0(0) ack 3572335638 win 0
15:29:59.026016 IP localhost.41664 > localhost.41664: UDP, length 1
15:29:59.026346 IP localhost.41664 > localhost.41664: UDP, length 1
15:29:59.126838 IP localhost.41664 > localhost.41664: UDP, length 1
15:29:59.127486 IP localhost.41664 > localhost.41664: UDP, length 1

So, you can use it to sniff your own traffic/IPC messages, but nobody else can see it on the network.

This is a very common case in systems to use a protocol like TCP or UDP for local IPC over the lo interface.