Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to learn to use tcpdump. I thought I'd eavesdrop on my ssh login. The setup is a bit unusual, I have OS X Lion running VirtualBox, with Ubuntu running in the VM. I have ssh enabled and can login from OS X normally:

> ssh -p 22 -l telliott
Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-17-generic i686)

 * Documentation:

0 packages can be updated.
0 updates are security updates.

Last login: Sat Mar 31 19:54:36 2012 from toms-mac-mini.local
telliott@U32:~$ logout
Connection to closed.

I have not obfuscated the ssh port on Ubuntu. From OS X, stroke gives what I expect:

> ./stroke 22 22
Port Scanning host:

     Open TCP Port:     22          ssh

So from OS X I do:

> sudo tcpdump -i en1 -v port 22
tcpdump: listening on en1, link-type EN10MB (Ethernet), capture size 65535 bytes

Then I login from OS X to Ubuntu using ssh, but I see nothing with tcpdump. Here is ifconfig from Ubuntu:

telliott@U32:~$ ifconfig
eth1      Link encap:Ethernet  HWaddr 08:00:27:d7:ba:0e  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::a00:27ff:fed7:ba0e/64 Scope:Link
          RX packets:799 errors:0 dropped:0 overruns:0 frame:0
          TX packets:465 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:96863 (96.8 KB)  TX bytes:68638 (68.6 KB)

Where are the packets I was hoping to see? Thanks for any help.

Update: on OS X

> ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
    ether 60:fb:42:f4:cd:9e 
    media: autoselect
    status: inactive
    ether 00:26:b0:fa:75:7f 
    inet6 fe80::226:b0ff:fefa:757f%en1 prefixlen 64 scopeid 0x5 
    inet netmask 0xffffff00 broadcast
    media: autoselect
    status: active
    lladdr 60:fb:42:ff:fe:f4:cd:9e 
    media: autoselect <full-duplex>
    status: inactive

Update 2:

Realized now this is a silly question because (i) tcpdump on port 22 on Ubuntu works as you'd expect and (ii) I never actually opened port 22 on OS X. ssh is working through some magic of the "bridged" mode of the VM that I don't understand yet. I'm trying to get the solution below working, as I'm sure it will.

share|improve this question
Can you add the output of ifconfig on the OSX box? Depending on how it's configured, you may or may not want to be using en1. – NathanG Apr 1 '12 at 2:19
up vote 1 down vote accepted

Try setting one of the VMs interfaces to Host-only, then use tcpdump to listen on vboxnet0

% sudo tcpdump -AXvnn -s0 -ivboxnet0 port 22
tcpdump: WARNING: vboxnet0: That device doesn't support promiscuous mode
(BIOCPROMISC: Operation not supported on socket)
tcpdump: listening on vboxnet0, link-type EN10MB (Ethernet), capture size 65535 bytes
05:33:38.767959 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) > Flags [S.], cksum 0x186b (correct), seq 3689124050, ack 844205722, win 14480, options [mss 1460,sackOK,TS val 4294808631 ecr 446189010,nop,wscale 5], length 0

Works for me, plus you can SSH to your VM if your network is offline.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.