virtualbox.org

I have three VMs in an internal networking environment. They are all connected to the same internal network and can communicate with one another just fine. If I open Wireshark on any of them I can capture the traffic among any two of them. I would actually like to have a capture of the entire network in a single pcap. Ideally, the internal switch would give me this possibility, but I don't see if this is possible and how.
Any suggestions? I already googled, but could not find any solutions.

Think of how you would solve this problem in real networked computers, and solve the same way in the Virtualbox network.

Spiros wrote:Ideally, the internal switch would give me this possibility,

How would a real switch enable this? VirtualBox's Internal switch is just an unmanaged switch.

Spiros wrote:have a capture of the entire network in a single pcap.

Can Wireshark capture traffic between three or more PCs in a single pcap? Would you need another computer in the network to do this: 4th PC to capture the other three, 5th PC to capture 4? Then add another guest.

However, This: https://www.wireshark.org/faq.html#promiscsniff and this: https://osqa-ask.wireshark.org/question ... rk-traffic suggest that a hub is needed as the connection point for the network, not a switch. From the Virtualbox manual, section 6:

the Oracle VM VirtualBox support driver will automatically wire the cards and act as a network switch

There is a 'promiscuous mode' on the Virtualbox network cards that might help. See the manual, section 6.11 in the 6.1.0 manual.

Activating the promiscuous mode did the trick. I enabled it on the server's interface connected to the internal network and now I can sniff the entire network from a single place.
Thanks.

Great! glad you're up and pcap-ing!