This is our old Q&A Site. Please post any new questions and answers at

Hi network experts,

My question is not directly related to wireshark. But when I start wireshark, the network behaviour is changed and I don't know why.

I have the following setup: Linux machine (OpenSuse 12.1) with one physical network interface. Interface has many IP's like, ...

KVM is running on this box using libvirt and virt-manage.

Second interface is a virtual bridge virbr0 with IP

One to One NAT is setup from the host to the guests using shorewall.

Everything works except, connecting from guest to it's own 'external' ip. Let's assume guest has IP and is nat-ed to; connections from this guest ( to are failing. Connecting to any other 192.168.1.x IP's are working find (including other virtual machines).

When I start wireshark on the host, connections from to start to work!

Any suggestion is appreciated.

Regards, happyp3nguin

asked 15 Feb '12, 18:56

happyp3nguin's gravatar image

accept rate: 0%

Even though I have no experience with your kind of setup, my guess is that putting the capture interface in Promiscuous mode (like Wireshark does by default when capturing) is the reason it suddenly works. You can verify this by using Wireshark without putting the interface in promiscuous mode.

permanent link

answered 16 Feb '12, 01:45

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

thanks for the answer, I have realized this today when I saw messages like this in the kernel log: device virbr0 entered promiscuous mode

(20 Feb '12, 08:13) happyp3nguin

(I converted your "answer" to a "comment", please see the FAQ for details)

(20 Feb '12, 08:23) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Feb '12, 18:56

question was seen: 2,560 times

last updated: 20 Feb '12, 08:23

p​o​w​e​r​e​d by O​S​Q​A