I have a VirtualBox machine with a single interface connected to VB's NAT mode. What I would like to do is sniff all traffic coming from/to any machine behind that NAT. (I don't think I will need to sniff on more machines at the same time).

Background for this is software testing. More specifically, I'd like to see in bigger picture what exactly goes from/to the machine without the need to filter out all the noise that the host is already producing.

I used to do this on Windows 7 with VMWare, where the traffic flew through a separate virtual interface on the host, so sniffing the traffic from (all) machines behind the NAT was as easy as sniffing on that interface only.

Now I tried to achieve the same setup on Debian with VirtualBox, and I stopped at the fact that VirtualBox does not seem to separate the traffic this way: on Debian Wireshark only offers eth0, nflog, lo and any (pseudo-device to capture on all others). When I sniff on eth0, I can't easily distinguish between what came from host and what came from guest.

Is it possible to do this with VirtualBox? Or is there a better (easier) setup?

Both machines are running Debian 7.0 Wheezy.

Note: What I was (maybe naively) thinking as a possible solution was: a way to distinguish on the outgoing packets that they have been translated. (Does NAT really not leave a trace?) Now it strikes me that this would at least definitely not be easy for incoming packets...


To do so, you have to create a bridge interface under Linux :

sudo brctl addbr br0

This will create a bridge interface that virtualbox can attach to.

Then you have to configure your virtual machine so that it uses this interface :

Configure bridged network on virtualbox

You can now sniff on br0 to see what's happening on your "virtual machines" network.

You may need to configure the br0 interface as well as NAT :

# Assign IP address (netmask to br0 
ip addr add dev br0
# Tell your host that it should masquerade (NAT) all virtual machines
iptables -A POSTROUTING -o <lan_interface> -j MASQUERADE

Remember that there is no DHCP server running in the br0 network so you will have to configure (IP addresses and default gateway) all your virtual machines manually.

Edit: Fixed syntax error in brctl command
Edit 2: Added information to configure the bridge interface

  • ...but I don't want to bridge the VM into the LAN; in fact I don't even think it would work (regarding local network security policy). May 14 '13 at 17:03
  • That does not bridge the VM into the lan (except if you choose your LAN interface under Name:). You create a different interface (ie a different network) into which you bridge your virtual machines.
    – Xion345
    May 14 '13 at 17:33
  • I have added the bridge but by ip addr show state is reported as DOWN and the guest card is "disconnected". I tried ifup br0 but that fails with Ignoring unknown interface br0=br0. May 14 '13 at 17:49
  • Also I still don't quite understand what your approach is. I liked having the guest behind NAT, since e.g. that way it was able to use VB's DHCP service. May 14 '13 at 17:53
  • I don't think there is a way to direct VM traffic to another interface while keeping the ability to use VB DHCP. You will have to either use the full VB NAT feature or manage the bridge interface yourself... Whoops... I think I am may be wrong. You might try the 'Host-only' mode.
    – Xion345
    May 14 '13 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.