VirtualBox to capture host subnet traffic

[pavlos1982]

Hi all,

i am using security onion on virtual box on a windows 10 host , under network adapter i change to allow all and promiscuous mode but i am only able to capture the host traffic i was wondering if anyone can help out and if it is posible for me not to be able to only capture the host traffic but the entire sub-net of that host ,is that possible?

regards

[scottgus1]

If you set to Bridged your guest should be able to see what traffic comes to the host PC. My understanding of network switches is that once the switch knows the IP or MAC address or other such of every computer attached to it, the traffic is only sent down that port. So a guest on a PC would only see what the switch sends on that port. There might be a 'mirror everything in the switch to this port mode' on the switch port your PC is connected to, which would allow the host PC and then the guest to see all the switch's traffic. I may be wrong...

[BillG]

That was possible with earlier networking systems (10base-T and 100base-T) which used hubs. As Scott said, with switches the traffic is sent directly, not broadcast on the wire.