Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to have a VirtualBox virtual machine that can't get online. I want to be able to monitor all network traffic attempts from the Linux host.

So, if the virtual machine attempts to make a SYN out to a random IP (that it can't route to) the Linux host will be able to see this traffic with tcpdump running. I believe I will need to setup some type of forwarding rules with IPtables.

Has anyone accomplished this?

share|improve this question


If desired you can add separate rules for your internal networks you want to allow.

All traffic is dropped on the monitoring PC

Then monitor using snort. snort should still be able to monitor the network since it operates more like tcpdump internally.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.