Page 1 of 1

Questions concerning networking between multiple VMs

Posted: 13. Feb 2013, 17:12
by ianaxel87
I have what I thought was a simple setup problem. No one so far has been able to help me with this, so I am hoping that someone here will be able to. I am highly time-constrained as regards this issue, so any quick insights would be greatly appreciated. Anyway, here is the problem and current setup.

Original problem: I want to have a virtualbox network consisting of three Ubuntu guests that can talk to each other and to the outside world. Further, I want one of these VMs to be able to sniff on the communications of the others. The communications it should be able to sniff are both those to other VMs on the network and those to the outside world.

Current solution: Currently, I have each VM using two network interfaces. One interface is NAT, which allows them to talk to the outside world. The other interface is Host-only, which allows them to talk to each other. They are indeed able to talk to the outside world and to each other, so it is successful in that respect.

The new problem: The issue now is that I can only sniff packets from one VM that are going to other VMs inside the network. I cannot, however, sniff packets that go from a VM to the outside world. (I have promiscuous mode enabled on the Host-only adapters.) I am doing security-related experiments that require exactly this sniffing, so it is crucial that I be able to sniff all outgoing and incoming packets. Is there something I am missing in the setup here? Any ideas? I have only a few days max to figure this out. I appreciate any help any of you are able to provide.

Thanks.

Re: Questions concerning networking between multiple VMs

Posted: 13. Feb 2013, 17:34
by Perryg
Having NAT is causing this issue for you and host-only probably is not what you really want to use unless you want the host added into the sniff.
I would set the guests to all use the Internal network (simulates a network switch) and use one of the guests as your router or add another dedicated guest router. Then you can use snort or what ever to monitor the "isolated" LAN.
The "router" guest would need two interfaces, one set to the internal adapter and one to the outside world using NAT or Bridged.