hoping for the virtual machine to be a 'network tap'.

configuration is an intel mac with an airport card and several usb nics. The airport card is for connectivity to the internet. the usb nics provide connectivity to the local lan. internet sharing is used on the mac to distribute internet access and the mac is also a file repository.

Internet sharing on the mac results in a dhcp serving addresses in a different class c for each nic-so one nic for example will get 192.168.2.x, the next nic gets 192.168.3.x, etc. This allows each nic to service a whole lan segment. Wireshark installed on the mac sees all interfaces and allows monitoring of traffic. I do not want to run wireshark natively on the mac. It's a production machine and messing around with the bare metal is discouraged. A virtual appliance is perceived as safer (even though it may not be, i cannot convince the responsible higher ups)

So, vmware fusion is set up on the mac to run an instance of windows xp sp3. wireshark is installed on windows.in this configuration, wireshark only sees the airport but not the usb nics. The network adapters are set up in bridged mode on vmware. Is there a tutorial that clarifies setup for the nics in fusion and the proper ip addresses they should have in windows? Should they be bridged there as well? If i use the same ip as that used on the mac, obviously i get an ip address conflict.

I was hoping for the virtual machine to be a 'network tap' but it's having trouble seeing the nics, let alone the traffic that is not even destined for it. i guess another way to solve this problem is to get the traffic to go through the xp instance. XP would need a dhcp server running. This dhcp server would service the nics. i tried tftpd but that is a little too rudimentary- it does not see the virtual interfaces. i'll keep looking but need some enlightenment.

please be gentle.

  • 1
    Wow - that's a whole lot of messing with ifconfig on bare metal. Why not drop another $29 on a "sniffing" USB ethernet adapter and just telling vmware to connect that device only to the XP instance? You could put that connection in whatever VLAN or DMZ configuration you wish and get a superior traffic analysis with no messing about.
    – bmike
    Commented Jul 17, 2011 at 15:46
  • Might not have another Ethernet jack to plug it into, though. Also, if that is plugged into a switch, it won't see traffic that is addressed to the Mac's port. Commented Jul 17, 2011 at 18:43

1 Answer 1


In bridged mode, the VM's port gets its own Ethernet MAC address. If VMNet acts like a switch, you might not see packets destined for the Mac's network node, which I assume is the point of this exercise.

Yes, the virtual port needs it's own IP address as well.

Internet sharing just passes along traffic not destined for the machine that is sharing. It is not a network bridge (it runs as a NAT IIRC), so it won't pass along broadcasts either.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .