Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a test environment setup with 4 VirtualBox guests running CentOS 6. Each has one network device attached to a bridged adapter, which is my primary network connection on my PC, with a static IP address (ranging from accessible by any device on my network.

Sometimes I need to be able to analyze packets for one reason or another. At first, I just SSH'ed into my router and used tcpdump to capture all packets from the guests. Well, it's not working as planned...

The only packets that show up using tcpdump is traffic between 98 and other devices on my network besides guests. 98 is the only guest that communicates to other devices on my network (besides SSH traffic); the rest communicate with other guests.

I started out filtering tcpdump by host for each of the guest IP addresses. I ended up stripping it all the way down to dumping everything. Since all the packets go through the network adapter on my PC, I captured all the packets for that card with still no success!

VirtualBox mangles, injects, and removes packets on the adapter when using bridged networking. If the packet is to go to another guest, does VirtualBox keep the packet and forward it on to the appropriate guest? If so, how can I capture those packets?

share|improve this question
What OS is your host computer? – heavyd Dec 26 '12 at 21:45
And does tcpdump (or other packet sniffer) on your host show any traffic? I would guess your host OS / VirtualBox are smart enough to not actually send packets to your router only to have them come right back on the same interface. – Goyuix Dec 26 '12 at 21:53
@heavyd - it's Windows 7. – Logan Bibby Dec 26 '12 at 21:59
@Goyuix - That's why I captured all the packets on the card. It shows the same thing as the dump from my router. If it does keep the packets, where can I find them? – Logan Bibby Dec 26 '12 at 22:01
up vote 3 down vote accepted

When you use VirtualBox's bridged networking mode the VirtualBox acts like a virtual switch between your host computer's physical interface and the virtual network. The packets traveling between computers on the virtual network never get to a point in the host networking stack where tcpdump can pick them up, so you can't see that traffic from the host.

You could try to use VirtualBox's built in network tracing feature. This is a debugging tool, but it generates pcap files and is built in an easy to setup. To enable network tracing you can use the VBoxManage command line with the --nictrace* options:

VBoxManage modifyvm [your-vm] --nictrace[adapter-number] on --nictracefile[adapter-number] file.pcap
share|improve this answer
Thanks! I'll have to try this out in a bit! – Logan Bibby Dec 27 '12 at 0:54
Tried it out and it worked like a charm. This is all I needed! I wish I could upvote this 10 times... You have no idea how long this issue has plagued me. – Logan Bibby Dec 27 '12 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .