Wireshark on virtualbox guest machine does not see specific packets, while the host does see the packet

asked 2018-04-05 08:52:46 +0000

erem
1 ●1 ●2 ●1

updated 2018-04-10 07:55:15 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

L.S.,

I hope someone can shed some light on the problem below, I am at the end of my rope

I run virtualbox 5.2.8 on a WIN7 machine, with a virtual machine running unbuntu 16.04. I have the virtual machine network adapter in bridged mode.

I am trying to detect the presence of an iphone on the network by doing a SYN-SYN-ACK-ACK three way handshake on port 62078 on the iPhone. (it is very difficult to detect iPhones ;-)) When I run wireshark on the host, I see the SYN packet leave the virtual machine, and I see the return SYN-ACK packet arrive at the host. I also run wireshark on the VM, and I see the SYN packet leave, but never see the return SYN-ACK packet, while see it in the capture on the host.

Since the VM adapter is in bridged mode, it should see ALL traffic on the host adapter. I am at the end of my rpe here.... Any help or guidance is appreciated.

answered 2018-04-10 08:36:42 +0000

grahamb

23835 ●4 ●973 ●227 https://www.wireshark.org

I can't be definite about this (I haven't tested) but I would be surprised (for security reasons) if a VB guest was able to capture non-VM traffic from the hosts NIC.

I suspect the allow_all promiscous setting is only intended to allow all VM traffic, not to include host traffic, or even other traffic that may be passing the host NIC. Looking at the 3 promiscuous mode options:

deny - only traffic for the VM guest
allow-vms - only traffic for other vms
allow-all - all VM traffic, i.e. the superset of the other 2 options.

That you can capture the outgoing packet from the host might be allowed through the Virtual NIC because of a bug or because it meets the VNIC filtering criteria.

Regardless of the above guesses, the best place to take this up would be with the VBox folks.

edit flag offensive delete link

Comments

Graham,

thanks, i do have that question out with the VM folks. However, if both adapters (host and VM) are in full promiscuous mode, they should see the packet. All other traffic (like mDNS, ICMP, ARP etc does show up in both instances of wireshark.

anyway, thanks for taking the time to reply

Regards,

Rob

erem ( 2018-04-10 08:43:36 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Wireshark on virtualbox guest machine does not see specific packets, while the host does see the packet

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Wireshark on virtualbox guest machine does not see specific packets, while the host does see the packet edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Wireshark on virtualbox guest machine does not see specific packets, while the host does see the packet