Snow Leopard running Fusion has virtual ports invisible to wireshark

[bwanaaa]

Win XP SP3 in fusion can surf the net through the mac's airport in either bridged or nat mode fine. the mac has a static ip. the windows is set to dhcp.

ifconfig on the mac shows

en1: inet 192.168.1.43 netmask 0xffffff00 broadcast 192.168.1.255

vmnet1: inet 172.16.193.1 netmask 0xffffff00 broadcast 172.16.193.255

vmnet8: inet 172.16.143.1 netmask 0xffffff00 broadcast 172.16.143.255

ipconfig on windows shows

        Connection-specific DNS Suffix . : home

    IP Address. . . . . . . . . . . . : 192.168.1.42
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 192.168.1.1

when the network adapter settings in fusion are changed to NAT and the ipconfig is released and renewed, then ipconfig shows

    Connection-specific DNS Suffix  . : localdomain
    IP Address. . . . . . . . . . . . : 172.16.143.132
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 172.16.143.2

This shows that the virtual machine is now going through the subnet of vmnet8 Wireshark however does not reveal vmnet8, just en0 and en1-and en1 is getting all the traffic. Why no vmnet8? Why is vmnet8 getting a routable address? shouldn't it be one of those non-routeable 192.xxx.xxx.xxx or 10.xxx.xxx.xxx numbers? And even if windows is bridged and using 192.168.1.42, little snitch on the mac keeps asking if vmnet-natd can talk to the net so i know it's active.

I can see packets going to the windows ip but it's mixed in with traffic going to the mac (as I'd expect since they are both using the same airport) but it's all going over en1.

( btw, i dont understand why the gateway in windows is not 172.16.143.1 but rather .2 - after all doesnt the windows box have to talk to vmnet8?)

[WoodyZ · Accepted solution]

Why is vmnet8 getting a routable address? shouldn't it be one of those non-routeable 192.xxx.xxx.xxx or 10.xxx.xxx.xxx numbers?

172.16.143.132 is a non-routable address.  Have a look "3. Private Address Space" in RFC 1597 - Address Allocation for Private Internets.

( btw, i dont understand why the gateway in windows is not 172.16.143.1 but rather .2 - after all doesnt the windows box have to talk to vmnet8?)

With the exception of VMnet0 the default for the last octet is alway 1 for all other VMnets on the Host and therefore the last octet for a Gateway IP Address with a NAT VMnet in the Guest defaults to 2.  These are coded into the VMware Virtual Network Infrastructure however can be easily changed in the Virtual Network Editor.  Oh, sorry, that's right VMware hasn't provided the Users of VMware Fusion with a Virtual Network Editor like in VMware Workstation or even their free VMware Player!   This means any changes to the VMnets will need to be done manually.

[bwanaaa]

tnx. appreciate the enlightenment. sry bout the confusion w 172.xxx.xxx.xxx. buffer overflow in my brain.

still cant get vmnet-sniffer to capture traffic.

dumbuser$ vmnet-sniffer -e vmnet8 -w testdump

gives an active process and a blank line in terminal (indicating it's active)

how to stop capture and save file?