Wireshark - VMWare : how to capture host traffic using wireshark in virtualmachine?

Question

I am try to capture the HTTP traffic from local server to remote server, but i cannot install directly wireshark on the machine because company's policy dont permit. I am administrator so i install VMware debian VM an installed Wireshark. The issue is i cannot spot the entire traffic from/to the host, i can only capture the HTTP packet from/to my virtual machine.

How can i configure the network adapter to see all the traffic from my PC to the web?

Some specs:

Host: Windows 8 , ethernet Controller Realtek PCIe GBE Family

VM: VMware® Workstation 12 Pro Version 12.1.1 build-3770994

Solution

This is the whole point of Virtual Machines - isolation.

I can't immediately tell you if you can capture the Host network traffic from a guest (e.g: using promiscuous mode), but it would help to know if you're using VMWare Workstation or VMWare Player.

An option would be to route your PC's traffic via the VM, which should also be against the company's policy and could be easy to get wrong...

I would recommend that you either

1. Just install Wireshark on the PC... you've already got VMWare and a VM, this would be arguably less of an infringement.
2. Find a hub (not switch) and a spare machine to put Wireshark on. Then put the switch between your PC and the wall, and hang the "Wireshark PC" off it too - reference. Again, this should be against the company's policy.

Comments

[Appleoddity]

You have to put the network adapter or virtual switch in promiscuous mode. It’s in the VMware settings, you can find information online. I’m not familiar VMware workstation. I just know how to do in esxi.

[Mike D3ViD Tyson]

i found only solutions about linux host, what about windows? is it possible??

[Mike D3ViD Tyson]

Thx for the answer, in the point 2 you mean a virtual hub?

[Attie]

No, a physical Ethernet hub.

[Mike D3ViD Tyson]

I have edit the question with VMWare Specs

[Mike D3ViD Tyson]

and about point 1 i cannot install wireshark in the host machine because they can spot it by using spiceworks agent (installed on my machine)

[HelpingHand]

You can use netsh to create a packet capture. One Google result: blogs.technet.microsoft.com/yongrhee/2012/12/01/… Also see if you can get RawCap.exe. It doesn't need to be installed and can easily sniff loopback and remote.

[Attie]

Any network monitoring (e.g: Wireshark) is likely to be against the company policy. If you're only worried about being found out, then that's a different question. Do you have a good reason to use Wireshark (for your job)? Have you asked IT for permission? They are usually reasonable guys!

[Attie]

If you're just worried about installing Wireshark, then you can run it as a "portable" application. Which is still likely to be against the policy.

[Mike D3ViD Tyson]

@Attie portable version can be a good solution, i have already ask to the IT but they are too busy for me!