Can you intercept packets being sent to a VM over ethernet?

Question

I have a VMware Workstation Pro instance with a bridged connection to a Gigabit PCI Express Network Adapter. I'm trying to intercept packets being sent to the VM from the Host.

When I use Wireshark on the host I don't see any network activity for the ethernet port. However, when I run Wireshark on the VM I do see the packets.

Is it possible for both the host and VM instance to "see" the packets? Do I need to change the connection from bridged to something else?

Answer 1

When using "bridged networking" mode you are bypassing the host network stack entirely. I believe that you will have more success when using the NAT networking mode.

Here is an idea for solving this issue, but you will need to test if it really does work.

The idea is to bridge the Host-Only Adapter with your LAN Adapter. Wireshark on the LAN Adapter might be able to then see the traffic of the VM.

You are using VMware, so I only note that VirtualBox seems to be able to capture a guest's traffic to a pcap file. See the article Network tips : Network tracing.