This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capturing traffic between two VMs

I have two virtual machines vm1 and vm2 running on my host with virtualbox, connected through a host-only adapter. I have Wireshark running on my host.

VM(1|2): Ubuntu
Host: Arch Linux

I have turned promiscuous mode to "allow-all" and set ifconfig vboxnet0 promisc on the network interface that virtualbox is using and I am listening to:

[email protected] ifconfig vboxnet0: flags=4419< UP,BROADCAST,RUNNING,PROMISC,MULTICAST > mtu 1500 inet 192.168.56.1 netmask 255.255.255.0 broadcast 192.168.56.255 inet6 fe80::800:27ff:fe00:0 prefixlen 64 scopeid 0x20<link> ether 0a:00:27:00:00:00 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 692 bytes 61427 (59.9 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

From my host system, I am able to capture traffic between vm* <=> host, but not vm1 <=> vm2. That is the goal I trie to achieve.

But from vm1 I am able to listen to traffic between vm2 <=> host.

My Settings for the network interface in wireshark are standard, so promiscuous mode is on. Is there any setting I have overseen?

promiscuous virtualbox

asked 19 Oct '17, 11:58

eknoes
6●1●1●2
accept rate: 0%

One Answer:

0	According to the answers in this question, some folks can capture the VM-VM traffic from the host, some can't. As noted on the question mentioned above, this would seem to be more a question for the VirtualBox support folks. answered 20 Oct '17, 01:37 grahamb ♦ 19.8k●3●30●206 accept rate: 22%