Steps
- Identify or create the VMnet for capturing network traffic.
If you’re using the standard version of VMware Fusion, this will be Share with my Mac (vmnet8), Private to my Mac (vmnet1), or Bridged (vmnet0). VMware Fusion Pro includes the feature to create additional custom VMnets with the virtual network editor. Note that a host adapter is not required to capture traffic on the VMnet.
- Create a named pipe (FIFO) file for the VMnet.
I prefer to create a separate file for each VMnet. It provides the flexibility to capture and display on multiple VMnets simultaneously. Run the following command in Terminal:
mkfifo /private/tmp/cap-vmnet15
- Open the Wireshark application.
First, we must verify wireshark is in our path. Run the following command in Terminal:
type wireshark
output:
wireshark is /Applications/Wireshark.app/Contents/MacOS/wireshark
Next, we will open Wireshark using the named pipe file as an interface. Run the following command in Terminal:
wireshark -k -i <(cat /private/tmp/cap-vmnet15) &
Recapture the command prompt by pressing the ⏎ key.
- Run the
vmnet-sniffertool.
Start the vmnet-sniffer tool with instructions to output (write) data to the named pipe file, and also select the specific VMnet we are capturing on. Run the following command in Terminal:
sudo /Applications/VMware\ Fusion.app/Contents/Library/vmnet-sniffer -w /private/tmp/cap-vmnet15 vmnet15 &> /dev/null
- Wouldn’t it be nice if a tool existed to simplify all this?
The vmnet-shark
tool encapsulates the previous steps and only requires a VMnet as the parameter. For example, in Terminal:
vmnet-shark vmnet15
- Happy Labbing!
The following is a network diagram for an Arista lab:
Wireshark displaying the details of a packet on the vmnet15 link:
