Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been trying to use Wireshark to capture some traffic that comes from a virtual machine.

The setup is:

  • Windows 7 host
  • Ubuntu guest
  • VirtualBox 4

I send some packets from the guest to the host or another IP in the host LAN. The packets get there, but Wireshark cannot see them.

I have run Wireshark on both the guest and the host. Curiously, if I send the packet to another computer, the packets are captured without problem in the second machine. I don't understand how I cannot capture the packets in the machine that is sending them.

How should I setup VirtualBox, Windows 7 or Wireshark in order to capture the packets sent by the guest machine?

share|improve this question
You can try if the following works out for you: Wireshark under virtualbox broken after version 4 – slhck Jun 17 '11 at 16:03
@slhck that is for running wireshark in the guest, he wast to know why it is not capturing on the host. – Scott Chamberlain Jun 17 '11 at 21:52
up vote 4 down vote accepted

When guest OS is set up, a network interface is assigned to it.
Is wireshark listening on that interface?
In linux, there is an option to use "any" interface, which listens on all possible network interfaces, but I don't know if such option exists on the windows.

Here is explained that wireshark in windows has difficulties listening on loopback interface, the interface used when machine sends messages to it self.

share|improve this answer
the link explaining the loopback problem in windows was very helpful. – santiagozky Jun 18 '11 at 15:42

Configure the Attached to: combo box to Bridged Adapter and set the Promiscuous Mode: combo box to Allow All.

Having done this I'm now seeing all traffic going to/from the guest OS.

share|improve this answer

I too had the same problem and now the issue was solved. The Above technique answered by Aji Abraham works well and if you want to know more and want to get good result then please check the below link as it only gave me the necessary details and now I am able to capture the packets from VM to VM and from VM to Host.


share|improve this answer

In my experience Wireshark only sees the host's really external network interfaces. For example, if you use a web browser to look at a web page served by a web-server on the same PC (http://localhost), you can't use Wireshark to look at this traffic.

Similarly, the delivery of data by the VM to the host is local and not directed through a physical NIC. Presumably this provides no structure in the host operating system that looks like a "network interface" to Wireshark.

share|improve this answer
As explained "here"( Windows do have problem listening on loopback interface (one used when browsing the localhost), but when wireshark is used on the linux, there are no such limitations – bbaja42 Jun 18 '11 at 18:17

I have an idea for solve your issue , too late but hope it help somebody else:)

Create Host-Only Adapter and bridge with your LAN Adapter. run wireshark on LAN Adapter, It will do the work

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.