' -s ' to 'stop sniffing after a specified number of seconds ' -c ' to 'stop sniffing after receiving a specified count of packets Or, you can take my word for it that it is: Enter 'rawcap ?' and mash the Enter key for the syntax for doing either of these.

Alternatively, you can specify the count of packets you want it to capture, or the number of seconds for which you want it to capture.

Once it is finished, you can go back to the command prompt and mash Ctrl+C. Now, perform the procedure that generates the network traffic you want to capture. IOW, the difference between the two ways of running it is: Do you want to get and dismiss the 'User Account Control' dialog before you enter the command line verbiage or after you enter it? If you use the latter option, the feedback (how many packets have been received) will display in a separate command prompt window: Select Start > 'cmd' > accept 'User Account Dialog' dialog Select Start > All Programs > Accessories > Command Prompt > r-click > Run as Administrator Run cmd as 'Normal' User and Respond to Prompt You can run RawCap one of two ways: Run cmd as Administrator Proactively So, for me, 0 is my PC's IP address, and 1 is localhost/loopback/127.0.0.1. You will then be given a list of interface IDs and what they refer to.

Can wireshark capture localhost traffic