virtual-machinepingwiresharkpacket-snifferspromiscuous-mode

sniffing packets from different VM's in Oracle VM VirtualBox


There is a situation: there are 2 Virtual computers(defined as A and B), runnig Ubuntu 16.04 each one. Network configure on both of them:

Adapter1 : Host-only with Promiscuous Allow All
Adapter2:  Nat Network with Promiscuous Allow VM's

both the computers have a difference mac addresses

PC A :
host only adapter with mac(080027B2EBC7)
NAT Network adapter with mac(0800273F605C)

PC B:
host onlt adapter with mac(0800272DC6FF)
Nat Network adapter with mac(080027B8CEC1)

computer A: sending a ping, through terminal, by the command :

ping google.com

while computer A is pinging im openning wireshark on computer B.

i cant see the icmp packets that im sending from PC A on the Wireshark on PC B.

ifconfig for both PC:

A:

    enp0s3    Link encap:Ethernet  HWaddr 08:00:27:b2:eb:c7  
          inet addr:192.168.56.103  Bcast:192.168.56.255  Mask:255.255.255.0
          inet6 addr: fe80::717a:1d3f:cf7d:a25f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:83 errors:0 dropped:0 overruns:0 frame:0
          TX packets:58 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:8788 (8.7 KB)  TX bytes:6807 (6.8 KB)

enp0s8    Link encap:Ethernet  HWaddr 08:00:27:3f:60:5c  
          inet addr:10.0.2.4  Bcast:10.0.2.255  Mask:255.255.255.0
          inet6 addr: fe80::955f:36a:18c3:706f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:17 errors:0 dropped:0 overruns:0 frame:0
          TX packets:65 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2689 (2.6 KB)  TX bytes:7197 (7.1 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:71 errors:0 dropped:0 overruns:0 frame:0
          TX packets:71 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:21609 (21.6 KB)  TX bytes:21609 (21.6 KB)

B:

   enp0s3    Link encap:Ethernet  HWaddr 08:00:27:2d:c6:ff  
          inet addr:192.168.56.101  Bcast:192.168.56.255  Mask:255.255.255.0
          inet6 addr: fe80::ca16:a283:da31:e0a2/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:97 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:11541 (11.5 KB)  TX bytes:6333 (6.3 KB)

enp0s8    Link encap:Ethernet  HWaddr 08:00:27:b8:ce:c1  
          inet addr:10.0.2.7  Bcast:10.0.2.255  Mask:255.255.255.0
          inet6 addr: fe80::b3c3:7fd:e18c:ccd3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:54 errors:0 dropped:0 overruns:0 frame:0
          TX packets:58 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:7449 (7.4 KB)  TX bytes:6511 (6.5 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:95 errors:0 dropped:0 overruns:0 frame:0
          TX packets:95 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 

maybe im have a wrong understanding about the Idea of VM Networks.

Thanks for helping


Solution

  • You didn't stated you question clearly, but I presume you want to see ICMP traffic on VM-B, when you ping google from VM-A, if so, then you have a mistake:

    Host-Only adapter via which you may reach VM-B doesn't work with outer/external/public (whatever is more clear) networks.

    you can use this command to check which iface is used for routing:

    ip route get $(host google.com | head -n1 | grep -oP '[0-9][0-9\.]+')

    If you want to have it routed as VM-A -> VM-B -> internet, then you have to make default (or dedicated) routes for that