I have a VirtualBox machine with a single interface connected to VB's NAT mode. What I would like to do is sniff all traffic coming from/to any machine behind that NAT. (I don't think I will need to sniff on more machines at the same time).
Background for this is software testing. More specifically, I'd like to see in bigger picture what exactly goes from/to the machine without the need to filter out all the noise that the host is already producing.
I used to do this on Windows 7 with VMWare, where the traffic flew through a separate virtual interface on the host, so sniffing the traffic from (all) machines behind the NAT was as easy as sniffing on that interface only.
Now I tried to achieve the same setup on Debian with VirtualBox, and I stopped at the fact that VirtualBox does not seem to separate the traffic this way: on Debian Wireshark only offers
any (pseudo-device to capture on all others). When I sniff on
eth0, I can't easily distinguish between what came from host and what came from guest.
Is it possible to do this with VirtualBox? Or is there a better (easier) setup?
Both machines are running Debian 7.0 Wheezy.
Note: What I was (maybe naively) thinking as a possible solution was: a way to distinguish on the outgoing packets that they have been translated. (Does NAT really not leave a trace?) Now it strikes me that this would at least definitely not be easy for incoming packets...