Re: [VBox-users] sniffing internal network from host

[Valery U. <uw...@st...>]

On Sun, Dec 28, 2025 at 15:32:29 +0100, Marco Moock wrote:

> I have 2 virtual machines connected via internal network intnet.
> 
> Is it possible to sniff the packages using Wireshark on the Debian Host?
> 
> If not, what is the right way to do that?
> 
> I only want to connect the 2 machines together, no connection to
> anything else outside, but the host should be able to sniff the
> packages. 
> 
> The vboxnet0 interface has 0 packets.

vnoxnet0 is not an "internal" network, it's a "host-only" network.  An
internal network is, well, internal and is not directly accessible
from the host as a regular network interface.

A host-only network is an internal network _plus_ a host interface
"plugged" into it.  So unless you have a reason for the VM to be
completely isolated from the host, you can just use a host-only
network for your two VMs to talk, and the host will be part of that
network too, so you can sniff traffic, etc.

If the network really must be internal, that is, not exposed to the
host (or/and host not exposed to the VMs), you still can access it
with vbox VMMR0 api.

I wrote as an exercise a https://en.wikipedia.org/wiki/Rump_kernel
component that exposed vbox internal networks to rump, so one can run
a rumpified app that can talk to the interal network using sockets API
(using netbsd rump network stack to do the talking).

You can probably look at

    src/VBox/NetworkServices/Dhcpd/VBoxNetDhcpd.cpp

in the open sources for an example of a small _standlone_ program that
talks to an internal network using vbox R0 api.  It plugs the network
into lwIP stack, but for your purposes you can just write frames to a
pcap file.


-uwe