[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Question regarding packet sniffing from a guest KVM

From: Stefan Hajnoczi
Subject: Re: Question regarding packet sniffing from a guest KVM
Date: Tue, 8 Sep 2020 17:23:28 +0100

On Fri, Aug 28, 2020 at 01:37:00PM +0000, Jacob Prida wrote:
> I saw your blog post 
> (http://blog.vmsplice.net/2011/04/how-to-capture-vm-network-traffic-using.html)
>  on packet sniffing, and was wondering if I could get your advice on a 
> problem I'm having.
> I posted this question to stackexchange as well 
> (https://unix.stackexchange.com/questions/606722/can-i-sniff-packets-on-a-host-interface-macvtap-through-a-guest-os-on-qemu-kvm)
>  but here is my problem:
> I want to packet sniff a physical NIC from a guest VM. The guest VM is 
> windows 10 with Wireshark/npcap. I want to setup the virtual network 
> interface to enable this packet sniffing. The host OS is RHEL 7. Currently, I 
> have the VM connected to a macvtap interface for the physical device I want 
> to sniff, but I am not seeing any data on Wireshark.
> Any help/advice is greatly appreciated.

Hi Jacon,
Sorry for the delay, I was offline and am catching up on emails.

Wireshark in the guest should see all packets sent to the VM's MAC

If you want promiscuous mode then I'm not sure if that's possible.
macvtap works by adding the VM's MAC alongside the physical NIC's MAC.
That means the guest network interface only receives packets with its
destination MAC address. But I'm not very familiar with macvtap, so
maybe someone has a different answer.


Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]