Can I view the http request made on a browser in a VM on a remote server from Wireshark on my PC?

edit

is the remote VM a linux machine? then you can setup something like xming on your local machine and ssh into target machine that will redirect X windows monitor for the remote machine to your local PC (assuming local is a windows box). not quite running on local machine but the window will be local so you can still see real time.

if both ends are linux machines you can also, through ssh, redirect the remote tcpdump output to a local machine; you can save to file or follow it to view the headers locally if you like. Depending on what the need is one or the other may come in handy for troubleshooting.

i've used both of the above options.

sorry doesn't quite answer your local wireshark need.

Hi VamsiKrishnaMeda,

I have answered a similar question in the past.

If the VM is running on your local PC then you should be able to capture it but you need to know how the VM is configured to reach the outside world.

Bridge mode

VM has its own IP address (sometimes called Bridged Networking) and uses your NIC.

You should be able to use a pretty simple display filter to show the traffic for that IP address only.

ip.addr == 1.2.3.4

NAT mode

VM "shares" the NIC with the host.

Filtering the traffic may prove more difficult because you won't be able to easily tell if the traffic is coming from the VM from the host.

You'll have better chance of capturing the HTTP if you don't run ANYTHING else on the host when you capture the traffic.

http should display the HTTP traffic you are looking for.

Hope this helps.

Cheers,

Spooky