4

Here is my setup:

  • A windows 7 laptop running as a host running VirtualBox
  • Inside Virtualbox, I have a debian VM.
  • The eth0 of the VM is created as a bridged device from the physical ethernet port on the laptop
  • On Windows, I run wireshark and sniff the ethernet device.

When I try to a host in the wild internet from the VM, it works but I can't capture any packets. But if I ping the laptop's IP address, wireshark sees the icmp traffic without problem.

Why is that?

1 Answer 1

7

You're using a bridged adapter which Wireshark cannot see. Basically, the bridging completely bypasses your laptop OS's network stack, so to your laptop this information isn't even being displayed.

If you wanted to capture data, you'd need to use NAT mode and port forward the ports for your guest. See this for detailed information.

3
  • thanks but I can't really understand this. This is not a hardware bridge. The packets still has to physically go out from the same wire, meaning the OS has to handle it. No?
    – lang2
    Jan 7, 2014 at 13:36
  • 1
    @lang2 Nope. It bypasses the Windows network stack and directly talks to the hardware. Wireshark listens at the OS level, not hardware.
    – Nathan C
    Jan 7, 2014 at 13:36
  • 1
    @NathanC This may be outdated information. Wireshark on a Windows 10 host can see communication between bridged-mode VirtualBox machines and devices on the network, in both directions.
    – Kaz
    Apr 29, 2021 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .