Issue
When the EWS is installed on the same machine using the service then all packets will be going to the localhost and will not hit the NIC so will not be captured in a Wireshark packet capture.
Product Line
EcoStruxure Building Operation, EcoStruxure Security Expert
Environment
- Security Expert
- Building Operation Enterprise Server
- Building Operation Automation Servers (AS-P, AS-B)
Cause
Packets sent between services on the same machine (like SOAP and EWS) do not hit the NIC and therefore cannot be captured with the default configuration of Wireshark using the WinPcap packet sniffing library.
Resolution
Replace WinPcap with Npcap to emulate a loopback NIC for packet capture.
- Go to https://nmap.org/npcap/ for details on the library.
- Download the library installer from https://nmap.org/npcap/#download
- Uninstall WinPcap.
- Install Npcap.
- Npcap will then create an adapter named Npcap Loopback Adapter. In Wireshark choose this adapter to capture, loopback traffic will be the seen the same way as other non-loopback adapters.
- This can be tested by typing in commands like "ping 127.0.0.1" (IPv4) or "ping ::1" (IPv6).
