How to capture traffic between computers in NAT Network?

Discussions related to using VirtualBox on Windows hosts.
Post Reply
abcuser
Volunteer
Posts: 590
Joined: 10. May 2007, 20:03
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu, Windows XP

How to capture traffic between computers in NAT Network?

Post by abcuser »

I use VirtualBox 7.0.8 on Windows 10 host. I have three virtual guests two of them are Rocky Linux 8.8 and one is Ubuntu 22.04 Desktop. I created NAT Network and on all of three virtualbox guests I have set the same "NAT Network" and set "Promiscuous mode" to "Allow all". Inside each of guest I have set the same IP range and I can see all three machines between each other (e.g. ping works on all of them pinging other two).

On Ubuntu Desktop I have installed Wireshark and I have checked in Capture | Capture Options there is check box "Enable promiscuous mode on all interfaces". On Ubuntu Desktop I have started to capture all of the traffic on interface "all" without any filters.

Then from first Rocky machine I have executed connection to second Rocky machine and got response back.

Now to the problem. I expected to see capture traffic in Ubuntu Desktop, but nothing is captured by Wireshark. I tried the same with tcpdump on Ubuntu Desktop and still nothing is captured.

Is there something else I need to set in VirtualBox to capture traffic?
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: How to capture traffic between computers in NAT Network?

Post by scottgus1 »

According to the manual https://www.virtualbox.org/manual/ch06. ... erformance all that's necessary is to set the Promiscuous dropdown. It doesn't appear that anything else is necessary in Virtualbox. That's not to say that some VM OS setting may not also be needed. (Personally I've never done a Wireshark trace that I can remember, so I wouldn't know the ins and outs.)

I'd try another Virtualbox network type as an experiment, in case there's a bug. Network, Bridged Adapter, Internal Network, and Host-Only Adapter are able to do Promiscuous.

Also consider rolling back to 6.1.something, to see if there's a 7.0 bug.
Post Reply