Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a virtual machine deployed in vmware fusion which is communicating with the host over the interface vmnet1. Unfortunately, wireshark does not offer me to to listen on that interface.

Is there a solution for wireshark to listen on that interface? Please note that I am running on Mac.

Thanks for that.

share|improve this question
up vote 9 down vote accepted

VMWare's products seem to be all over the place with respect to capturing on the host. As davey says, on Linux you capture on the host without any trouble. Server on Windows lets you list interfaces but not capture from them. Fusion doesn't provide a BPF device so you can't capture using tcpdump or Wireshark. They do provide their own capture utility, although it doesn't support filtering:

/Library/Application\ Support/VMware\ Fusion/vmnet-sniffer

The equivalent on Windows (in case anyone needs it) is vnetsniffer.

On Mac VMware Fusion 5, the location is:

share|improve this answer

This maybe a "Fusion" thing. I can definitely capture the "vmnet" interfaces using Wireshark on my linux boxes.

Question: Can you use "tcpdump" against the vmnet interfaces:

$ sudo tcpdump -i vmnet1 -w /tmp/vmnet1.dmp

Then use wireshark to view the capture file?

share|improve this answer
seems tcpdump on vmnets dont work, just tried it out. – eQuiNoX__ Oct 15 '11 at 19:49

What are you trying to achieve?

You could listen for packets on your physical interface which it is routed/bridged through. Then, with the source/destination IP, you can make out which packets are going to/from the VM instead of the host.

share|improve this answer
I would like to be able to see the packets going through the interface vmnet1. Wireshark simply does not offer me to intercept those packets. Does that makes more sense? Sorry if my original post was not clear enough. – Benjamin Dec 16 '09 at 5:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.