This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to solve a problem in an ESXi/XP environment. The VM is running XP and Wireshark, The host is running Solaris.

Wireshark shows a packet leaving the VM but the Solaris server never sees the packet, nor does the span port on the Cisco switch. The vendor of the VM installed an Intel driver and right now that is where our suspicions are focused. He will fix that today.

But the question I have is where does Wireshark 'pick-up' the packet, if it actually never leaves the Intel NIC? This information would be useful to know so I could confidently rule out the NIC in this case and in other cases too.

I am planning to install Cisco 1000V to test the virtual switch but was hoping someone knew of documentation of Wireshark/tcpdump/snoop order-of-operation.

asked 15 Dec '11, 07:24

ttpm's gravatar image

ttpm
1111
accept rate: 0%

I have a similar issue. Have you found a resolution to your issue yet?

(10 Jan '12, 11:40) jc931r

If I understand your question correctly you're running Wireshark inside the VM and capture the packet, but you do not see it outside the ESXi?

Wireshark picks up packets before it actually goes out onto the "wire" (or to the vSwitch of the ESXi, in this case), so seeing it in a capture done inside the VM does not mean it actually left it. You might want to enable promiscuous mode on the vSwitch and attach another VM with Wireshark running to see if the vSwitch got the packet at all (a vSwitch in promiscuous mode will forward all incoming packets to all ports, just like a hub does).

permanent link

answered 15 Dec '11, 08:10

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×24
×10
×9

question asked: 15 Dec '11, 07:24

question was seen: 2,213 times

last updated: 10 Jan '12, 12:35

p​o​w​e​r​e​d by O​S​Q​A