Very interesting...would love to learn more about how you found this if you're able to share! It does indeed seem to capture lo0 traffic now, though I can only see TCP, not UDP (relatively certain there should be UDP traffic as that's what I was trying to investigate in the first place). Regardless, I appreciate your investigation into this, thank you! Thanks, Mohamed

ooh, interesting note about nettop, I actually didn't know that command exists...out of curiosity how did you find out it was using the same infratructure as nettop? did you trace instruments itself or something like that? For the enhancement request, see FB19925681.

Thanks for your response. [quote='855489022, DTS Engineer, /thread/798055?answerId=855489022#855489022'] I’m not familiar with that. Please post a link to the doc you’re referring to. [/quote] Maybe "documentation" is the wrong word, but I'm referring to the information about that schema that is viewable in the instruments "document inspector" accessible from "document" in the menu bar -> "inspector" -> "schemas". This seems to be the only "documentation" available describing instruments' schemas/tables, but it doesn't say anything about how these tables are populated. I know from the available WWDC talks that we can create custom modelers that use these tables, so I was hoping that maybe the fact that localhost traffic wasn't showing up was that the "Network Connections" instrument itself was configured to not show it but that the data was available in the table. Because if I'm not mistaken, the only way currently to provide custom inputs into instruments is with os_signposts? which in my case is something I can't do since I can't modify the source of the application I wish to trace for.