3
How can I use Wirehsark to capture packets from VMs using bridged interfaces ? My setup is:
Windows PC with VMWare Workstation - Three physical network interfaces, each assigned a static IP - Three Linux VMs each bridged to one of the physical network interfaces but also assigned a seperate static IP address (to avoid an IP conflict - is this correct ?)
MAC OSX with VMWare Fusion -1 physical network interfaces -1 Kali Linux VM (running Wireshark in promsc mode) bridged to the physical network interface
I am trying to run Kali on the MAC and capture all packets between the VMs. If I ping Kali (on MAC) from a linux VM (on PC) wirehsark sees the packets. If however I ping between the Linux VMs (on PC) wireshark on Kali does not see the ICMP requests.
I read that Wireshark cannot see packets on bridged interfaces and the advice was to use NAT, however im not sure this would work in the setup, as although I could get the three VMS to have an ip address in the correct subnet , they would all be resolved to the physical cards IP address, which would be on a different IP range.
Any ideas of how best to configure my lab to allow VMs on the MAC and PC to use the same subnet range, and for wireshark to capture all traffic on the whole network
If you select the physical interface in Wireshark, it can capture both packets coming from VM and host. – Biswapriyo – 2017-12-19T16:35:16.700
thanks for reply @Biswa I am pretty sure im selecting the physical interface in wireshark, and I can capture packets being sent to the bridged interface on the mac. The packets I cannot capture are those on the network which are not sent directly to the VM running wireshark. The option for promiscuous mode is selected so I assumed I would be able to see all packets on the network ? – Bat – 2017-12-19T20:43:59.037