> so tshark can capture loop back, this is the the one that I tried: I would not expect tshark to be able to capture the loop back either (though haven't tried). It uses the same packet-capture interface as tcpdump, and I believe the Solaris kernel simply does not provide support for capturing loopback packets. Vern