This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How do I capture packets on a Windows virtual server?

0

Using Wireshark of course.

asked 05 Aug '13, 04:20

dhop's gravatar image

dhop
11112
accept rate: 0%

edited 05 Aug '13, 13:43

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142

Are you looking to capture on the VM host or in the VM itself?

(05 Aug '13, 12:18) grahamb ♦

Looking at capturing in the VM itself. We have two VM host chassis with several virtual servers that were created in each one. One VM host is using Cisco 1000v for its virtual switch. The other one is currently using HP's virtual switch. I need to capture packets in both environments. I started with the 1000v environment and wanted to have a seperate VM server/workstation run Wireshark and have its virtual port be a destination SPAN port for another server's source port. When I do this, my virtual network to the wireshark virtual server (remote desktop access) is dropped. I will end up placing wireshark on the virtual server I want to capture packets to work around this issue. However, I want to be able to run wireshark on another virtual server so that it won't possibly cause problems on a production virtual server. I haven't started to work with the HP virtual switch.

(06 Aug '13, 04:21) dhop

One Answer:

1

Perhaps the following presentation given by Jasper Bongertz at Sharkfest '11 will be useful to you: Wireshark vs. "The Cloud".

answered 05 Aug '13, 13:46

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

1

You can also check my blog for two posts explaining capture on VMware vSphere, in case that's what you need: http://blog.packet-foo.com/2013/04/capturing-packets-of-vmware-machines/

(05 Aug '13, 16:00) Jasper ♦♦