title: Capturing packets on loopback
body: <p>This code works perfectly fine on Ubuntu 16.04 and prints correct value (ETHERTYPE_IP) when I toss around UDP bytes via loopback interface:</p>
  
  <pre><code>#include &lt;pcap.h&gt;
  #include &lt;iostream&gt;
  #include &lt;net/ethernet.h&gt;
  
  int main(int argc,char **argv)
  {
      char errbuf[PCAP_ERRBUF_SIZE];
      auto pcap = pcap_open_live("lo0", BUFSIZ, 0, 1000, errbuf);
  
      pcap_loop(pcap,0, [] (u_char *self, const struct pcap_pkthdr *header,
                            const u_char *packet) {
          auto eth = (struct ether_header *) packet;
          auto eth_type = ntohs(eth-&gt;ether_type);
          std::cout &lt;&lt; "eth_type: " &lt;&lt; std::hex &lt;&lt; eth_type &lt;&lt; std::endl;
      }, nullptr);
  
      return 0;
  }
  </code></pre>
  
  <p>netcat:</p>
  
  <pre><code>➜  ~ nc -uv -l 54321
  Listening on [0.0.0.0] (family 0, port 54321)
  
  ➜  ~ nc -4u localhost 54321
  hello
  </code></pre>
  
  <p>Program output:</p>
  
  <pre><code>➜  ~ sudo ./a.out
  eth_type: 800
  </code></pre>
  
  <p>However on OS X 10.11.5 it prints <strong>eth_type: 4011</strong>. Interesting that it works fine with <strong>en1</strong> adapter.</p>
  
  <p>Why there is such a difference between loopback and non-loopback adapters and what is the correct way to capture packets on both?</p>
  
  <p><strong>Update:</strong>
  tcpdump also works:</p>
  
  <pre><code>➜  ~ sudo tcpdump -i lo0
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on lo0, link-type NULL (BSD loopback), capture size 262144 bytes
  15:09:00.160664 IP localhost.54321 &gt; localhost.63543: UDP, length 4
  </code></pre>