Re: Question regarding packet sniffing from a guest KVM

[Stefan Hajnoczi]

On Fri, Aug 28, 2020 at 01:37:00PM +0000, Jacob Prida wrote:
> I saw your blog post 
> (http://blog.vmsplice.net/2011/04/how-to-capture-vm-network-traffic-using.html)
>  on packet sniffing, and was wondering if I could get your advice on a 
> problem I'm having.
> 
> I posted this question to stackexchange as well 
> (https://unix.stackexchange.com/questions/606722/can-i-sniff-packets-on-a-host-interface-macvtap-through-a-guest-os-on-qemu-kvm)
>  but here is my problem:
> 
> I want to packet sniff a physical NIC from a guest VM. The guest VM is 
> windows 10 with Wireshark/npcap. I want to setup the virtual network 
> interface to enable this packet sniffing. The host OS is RHEL 7. Currently, I 
> have the VM connected to a macvtap interface for the physical device I want 
> to sniff, but I am not seeing any data on Wireshark.
> 
> Any help/advice is greatly appreciated.

Hi Jacon,
Sorry for the delay, I was offline and am catching up on emails.

Wireshark in the guest should see all packets sent to the VM's MAC
address.

If you want promiscuous mode then I'm not sure if that's possible.
macvtap works by adding the VM's MAC alongside the physical NIC's MAC.
That means the guest network interface only receives packets with its
destination MAC address. But I'm not very familiar with macvtap, so
maybe someone has a different answer.

Stefan

signature.asc
Description: PGP signature