Sniffing the Vmware vmnet1 network with Wireshark

I have a virtual machine deployed in vmware fusion which is communicating with the host over the interface vmnet1. Unfortunately, wireshark does not offer me to to listen on that interface.

Is there a solution for wireshark to listen on that interface? Please note that I am running on Mac.

Thanks for that.


VMWare's products seem to be all over the place with respect to capturing on the host. As davey says, on Linux you capture on the host without any trouble. Server on Windows lets you list interfaces but not capture from them. Fusion doesn't provide a BPF device so you can't capture using tcpdump or Wireshark. They do provide their own capture utility, although it doesn't support filtering:

/Library/Application\ Support/VMware\ Fusion/vmnet-sniffer

The equivalent on Windows (in case anyone needs it) is vnetsniffer.

On Mac VMware Fusion 5, the location is:

/Applications/VMware\ Fusion.app/Contents/Library/vmnet-sniffer

This maybe a "Fusion" thing. I can definitely capture the "vmnet" interfaces using Wireshark on my linux boxes.

Question: Can you use "tcpdump" against the vmnet interfaces:

$ sudo tcpdump -i vmnet1 -w /tmp/vmnet1.dmp

Then use wireshark to view the capture file?