Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have been trying to use Wireshark to capture some traffic that comes from a virtual machine.

The setup is:

  • Windows 7 host
  • Ubuntu guest
  • VirtualBox 4

I send some packets from the guest to the host or another IP in the host LAN. The packets get there, but Wireshark cannot see them.

I have run Wireshark on both the guest and the host. Curiously, if I send the packet to another computer, the packets are captured without problem in the second machine. I don't understand how I cannot capture the packets in the machine that is sending them.

How should I setup VirtualBox, Windows 7 or Wireshark in order to capture the packets sent by the guest machine?

share|improve this question
    
You can try if the following works out for you: Wireshark under virtualbox broken after version 4 –  slhck Jun 17 '11 at 16:03
    
@slhck that is for running wireshark in the guest, he wast to know why it is not capturing on the host. –  Scott Chamberlain Jun 17 '11 at 21:52
add comment

4 Answers

up vote 2 down vote accepted

When guest OS is set up, a network interface is assigned to it.
Is wireshark listening on that interface?
In linux, there is an option to use "any" interface, which listens on all possible network interfaces, but I don't know if such option exists on the windows.

Here is explained that wireshark in windows has difficulties listening on loopback interface, the interface used when machine sends messages to it self.

share|improve this answer
    
the link explaining the loopback problem in windows was very helpful. –  santiagozky Jun 18 '11 at 15:42
add comment

Configure the Attached to: combo box to Bridged Adapter and set the Promiscuous Mode: combo box to Allow All.

Having done this I'm now seeing all traffic going to/from the guest OS.

share|improve this answer
add comment

In my experience Wireshark only sees the host's really external network interfaces. For example, if you use a web browser to look at a web page served by a web-server on the same PC (http://localhost), you can't use Wireshark to look at this traffic.

Similarly, the delivery of data by the VM to the host is local and not directed through a physical NIC. Presumably this provides no structure in the host operating system that looks like a "network interface" to Wireshark.

share|improve this answer
    
As explained "here"(wiki.wireshark.org/CaptureSetup/Loopback) Windows do have problem listening on loopback interface (one used when browsing the localhost), but when wireshark is used on the linux, there are no such limitations –  bbaja42 Jun 18 '11 at 18:17
add comment

I have an idea for solve your issue , too late but hope it help somebody else:)

Create Host-Only Adapter and bridge with your LAN Adapter. run wireshark on LAN Adapter, It will do the work

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.