[Question/Docs] Why are SOCKS packets not visible on loopback capture?

[LPL-hacker]

Background

A user runs both the client and the server on the same machine and captures traffic on the loopback interface with Wireshark, but cannot identify expected SOCKS packets.

Possible reasons

• The browser may be speaking HTTP to the local client instead of SOCKS, depending on -recv
• Traffic between client and server may already be transformed / obfuscated, so it no longer looks like plain SOCKS on the wire
• The capture may be looking at the wrong port or wrong segment of the local proxy chain

Clarifications still needed

• Which ports were captured
• Whether the local application was configured for HTTP proxy or SOCKS5 proxy
• Whether the missing packets are expected on browser -> client traffic, or on client -> server traffic

Suggested follow-up

• Document the proxy chain for http and socks5 modes
• Add a troubleshooting section describing what should be visible on which local port
• If needed, provide a sample Wireshark capture workflow for same-machine debugging