Wireshark-users: Re: [Wireshark-users] capturing traffic on a virtual interface
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 29 Jul 2009 23:53:01 -0700

On Jul 29, 2009, at 10:49 PM, Sake Blok wrote:
No, if you are browsing the site (which is hoted on the VM) from within 
the VM,
...or if you are browsing a site hosted on *any* machine (real or virtual) from the same machine... 


then the traffic won't pass the NIC driver and won't pass the
WinPcap capture engine.
This is a limitation of the way the Windows networking stack works. Solaris has a similar problem; on some other UN*Xes, you can capture that traffic, *but* you have to capture on the OS's "loopback" device ("lo" on Linux, "lo0" on *BSD, Mac OS X, and Digital/Tru64 UNIX). 

See

	http://wiki.wireshark.org/CaptureSetup/Loopback

for details.