RawCap is a free raw sockets sniffer for Windows. Rawcap can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback).

Features:

Can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback)

RawCap.exe is just 17+ KB

No external libraries or DLL's needed

No installation required, just download RawCap.exe and sniff

Can sniff most interface types, including WiFi and PPP interfaces

Minimal memory and CPU load

Reliable and simple to use

Usage

RawCap takes two arguments; the first argument is the IP address or interface number to sniff from, the second is the path/file to write the captured packets to.

Raw sockets limitations in Vista and Win7
Due to current limitations in the raw sockets implementations for Windows Vista and Windows 7 we suggest running RawCap on Windows XP. The main problem with raw socket sniffing in Vista and Win7 is that you might not receive either incoming packets (Win7) or outgoing packets (Vista).