Ask Your Question
0

Can I view the http request made on a browser in a VM on a remote server from Wireshark on my PC?

asked 2019-09-25 04:26:57 +0000

updated 2019-09-26 04:22:49 +0000

Guy Harris gravatar image

I am making an http request on a browser in a VM. How can I view the http request from Wireshark running on my local PC? Is it possible to do so? Edit: The VM is not running on my PC. It is a remote system that I can access either through a web client or an application.

edit retag flag offensive close merge delete

Comments

The VM is not running on my PC. It is a remote system that I can access either through a web client or an application.

So there's a VM running on a server somewhere in The Cloud(TM), and you're running an web client or application on your machine that displays the contents of the display of the VM, as sent over the network, and takes keystrokes you type and mouse movements/mouse button presses you make and sends them over the network to the VM, where they are made to look like input from the VM's (simulated) mouse/keyboard?

That's the only network traffic between you and the VM?

Guy Harris gravatar imageGuy Harris ( 2019-09-26 04:18:14 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted
0

answered 2019-09-26 20:27:06 +0000

atrain1111 gravatar image

updated 2019-09-26 20:41:07 +0000

is the remote VM a linux machine? then you can setup something like xming on your local machine and ssh into target machine that will redirect X windows monitor for the remote machine to your local PC (assuming local is a windows box). not quite running on local machine but the window will be local so you can still see real time.

if both ends are linux machines you can also, through ssh, redirect the remote tcpdump output to a local machine; you can save to file or follow it to view the headers locally if you like. Depending on what the need is one or the other may come in handy for troubleshooting.

i've used both of the above options.

sorry doesn't quite answer your local wireshark need.

edit flag offensive delete link more
0

answered 2019-09-26 02:51:26 +0000

updated 2019-09-26 02:51:56 +0000

Hi VamsiKrishnaMeda,

I have answered a similar question in the past.

If the VM is running on your local PC then you should be able to capture it but you need to know how the VM is configured to reach the outside world.

Bridge mode

VM has its own IP address (sometimes called Bridged Networking) and uses your NIC.

You should be able to use a pretty simple display filter to show the traffic for that IP address only.

ip.addr == 1.2.3.4

NAT mode

VM "shares" the NIC with the host.

Filtering the traffic may prove more difficult because you won't be able to easily tell if the traffic is coming from the VM from the host.

You'll have better chance of capturing the HTTP if you don't run ANYTHING else on the host when you capture the traffic.

http should display the HTTP traffic you are looking for.

Hope this helps.

Cheers,

Spooky

edit flag offensive delete link more

Comments

The VM is not running on my PC. It is a remote system that I can access either through a web client or an application.

VamsiKrishnaMeda gravatar imageVamsiKrishnaMeda ( 2019-09-26 03:11:43 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-09-25 04:26:57 +0000

Seen: 369 times

Last updated: Sep 26 '19