Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to learn to use tcpdump. I thought I'd eavesdrop on my ssh login. The setup is a bit unusual, I have OS X Lion running VirtualBox, with Ubuntu running in the VM. I have ssh enabled and can login from OS X normally:

> ssh -p 22 10.0.1.2 -l telliott
Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-17-generic i686)

 * Documentation:  https://help.ubuntu.com/

0 packages can be updated.
0 updates are security updates.

Last login: Sat Mar 31 19:54:36 2012 from toms-mac-mini.local
telliott@U32:~$ logout
Connection to 10.0.1.2 closed.
>

I have not obfuscated the ssh port on Ubuntu. From OS X, stroke gives what I expect:

> ./stroke 10.0.1.2 22 22
Port Scanning host: 10.0.1.2

     Open TCP Port:     22          ssh

So from OS X I do:

> sudo tcpdump -i en1 -v port 22
Password:
tcpdump: listening on en1, link-type EN10MB (Ethernet), capture size 65535 bytes

Then I login from OS X to Ubuntu using ssh, but I see nothing with tcpdump. Here is ifconfig from Ubuntu:

telliott@U32:~$ ifconfig
eth1      Link encap:Ethernet  HWaddr 08:00:27:d7:ba:0e  
          inet addr:10.0.1.2  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fed7:ba0e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:799 errors:0 dropped:0 overruns:0 frame:0
          TX packets:465 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:96863 (96.8 KB)  TX bytes:68638 (68.6 KB)

Where are the packets I was hoping to see? Thanks for any help.

Update: on OS X

> ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=3<RXCSUM,TXCSUM>
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=27<RXCSUM,TXCSUM,VLAN_MTU,TSO4>
    ether 60:fb:42:f4:cd:9e 
    media: autoselect
    status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether 00:26:b0:fa:75:7f 
    inet6 fe80::226:b0ff:fefa:757f%en1 prefixlen 64 scopeid 0x5 
    inet 10.0.1.3 netmask 0xffffff00 broadcast 10.0.1.255
    media: autoselect
    status: active
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
    lladdr 60:fb:42:ff:fe:f4:cd:9e 
    media: autoselect <full-duplex>
    status: inactive

Update 2:

Realized now this is a silly question because (i) tcpdump on port 22 on Ubuntu works as you'd expect and (ii) I never actually opened port 22 on OS X. ssh is working through some magic of the "bridged" mode of the VM that I don't understand yet. I'm trying to get the solution below working, as I'm sure it will.

share|improve this question
1  
Can you add the output of ifconfig on the OSX box? Depending on how it's configured, you may or may not want to be using en1. –  NathanG Apr 1 '12 at 2:19

1 Answer 1

up vote 1 down vote accepted

Try setting one of the VMs interfaces to Host-only, then use tcpdump to listen on vboxnet0

% sudo tcpdump -AXvnn -s0 -ivboxnet0 port 22
tcpdump: WARNING: vboxnet0: That device doesn't support promiscuous mode
(BIOCPROMISC: Operation not supported on socket)
tcpdump: listening on vboxnet0, link-type EN10MB (Ethernet), capture size 65535 bytes
05:33:38.767959 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
192.168.56.3.22 > 192.168.56.1.56137: Flags [S.], cksum 0x186b (correct), seq 3689124050, ack 844205722, win 14480, options [mss 1460,sackOK,TS val 4294808631 ecr 446189010,nop,wscale 5], length 0

Works for me, plus you can SSH to your VM if your network is offline.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.