Page 1 of 1

unable to sniff "port monitor" data on guest after 10.0.4

Posted: 5. Jul 2011, 18:36
by ferdis
I have installed XP guest OS with wireshark and winpcap on Windows 7 host.
I use bridged network.
I am able to sniff all network traffic from guest and also broadcasts on guest wireshark.
I was also able to sniff network traffic from other network PCs if I defined my port (router Draytek Vigor 2930n) as "port monitor" on guest wireshark (It worked on host OS too).
This last feature stopped working after installing 4.0.6 version (same problem in 4.0.10). It works after reinstalling back to 4.0.4 or 4.0.2.
Host OS still can capture all data, but guest OS can capture only broadcasts and data for guest IP.
Is it feature, or bug? Does anyone know how to enable capturing also other traffic?

thanks for help

Re: unable to sniff "port monitor" data on guest after 10.0.4

Posted: 5. Jul 2011, 18:40
by Perryg
VBoxManage setextradata VM_NAME "VBoxInternal/Devices/pcnet/0/LUN#0/Config/IfPolicyPromisc" "allow-all"

This line is for the first PCNet card of your guest. Replace "pcnet" by "e1000" if your VM uses an E1000 card. The next major release will allow to use VBoxManage modifyvm but this was not possible to implement for VBox 4.0.

Re: unable to sniff "port monitor" data on guest after 10.0.4

Posted: 5. Jul 2011, 19:23
by ferdis
Thank you very much for fast solution.
It worked for me. (only removed apostrophes from "VBoxInternal/Devices/pcnet/0/LUN#0/Config/IfPolicyPromisc")