Where Wireshark fails, this great tool comes into rescue. Just came across it, wanted to share. It can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback): http://www.netresec.com/?page=Blog&month=2011-04&post=RawCap-sniffer-for-Windows-released