Can i capture 127.0.0.0 and 0.0.0.0 network using wireshark?

Question

Yeah, I've done capturing 127.0.0.1 ( loopback address ) using GNS . But it is possible to capture 127.0.0.0/8 and 0.0.0.0 direclty from any adapter on our device?

Here is a network route of my device

route print

and here is my ping response of both 127.0.0.0 network reply by 127.0.0.1 and 0.0.0.0 reply by my own ip with message "Not reachable "

ping 127.0.0.1

now ,

ping 0.0.0.0

i always wonder where upto it goes while doing pinging 127.0.0.0 and 0.0.0.0 but i've idea about it check working of TCP/IP suits while pinging 127.0.0.0

Answer 1

By design, the 127.0.0.0/8 network is supposed to respond even when there's no network adapter in the machine.

When you ping an address in this network, it doesn't goes down to the hardware layer, not even to the L2. The request is handled and responded to in the Internet (Network) layer of the TCP/IP stack.

So you cannot capture it on any other adapter than the loopback adapter(except maybe if you configure a port mirroring of the loopback adapter to another NIC or other unusal setup of packet forwarding).

Concerning the 0.0.0.0 address
It is reserved and should only be used as a source address in a initialization process I.E. DHCP / BOOTP.

It is not a valid destination IP address, as per RFC1122

Whether a host will respond to a ping to 0.0.0.0 is implementation dependent. Windows and MacOs doesn't handle it, while Linux Debian respond:

Windows

ping 0.0.0.0

Pinging 0.0.0.0 with 32 bytes of data:
PING: transmit failed. General failure.
PING: transmit failed. General failure.

MacOS

~$ ping 0.0.0.0
PING 0.0.0.0 (0.0.0.0): 56 data bytes
ping: sendto: No route to host

Linux Debian

~$ ping 0.0.0.0
PING 0.0.0.0 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_req=1 ttl=64 time=0.038 ms
64 bytes from 127.0.0.1: icmp_req=2 ttl=64 time=0.015 ms