Vista - Running a sniffer on VPC guest and only seeing "incoming" to VPChost

Hi,

I have a VPC guest where I installed Wireshark, and when I enable
capture in Wireshark, it appears to be only capturing the packets that
are coming into the VPC host.

For example, if I start IE on the host (while Wireshark is running on
the VPC guest that is running on the VPC host), and go to
http://www.google.com, I can see the HTTP response from Google, but I
don't see the HTTP request.

I've tried another sniffer, and it's doing the same thing.

Can anyone tell me why this is happening, and is there a way to get a
sniffer running on a VPC guest to be able to "see" both requests and
responses?

Thanks,
Jim

Hi,

I just found a strange thing.

If I run a browser on a 2nd VPC guest, and I can then see both the
requests and responses in the sniffer running on the 1st VPC guest.

So, to summarize, I have two VPC guests:

Host - I have a browser on this, and I browse to Google
VPCguest1 - Wireshark is running on this VPC guest
VPCguest2 - I have a browser running on this, and I browse to, for
example, http://www.google.com

If I browse to Google on the IE on the Host, I only see the responses
from Google to the IE in Wireshark (running on VPCguest1).

If I browse to Google on the IE on VPCguest2, I can see both the
requests from IE to Google and the responses from Google to IE in
Wireshark (running on VPCguest1).

Can anyone explain why is happening?

Thanks,
Jim



ohaya wrote:

http://blogs.msdn.com/virtual_pc_guy...27/774228.aspx


--
Bob Comer



On Thu, 30 Apr 2009 00:03:45 -0400, ohaya <ohaya@xxxxxx> wrote:

Bob,

AHH! Ok, thanks for the link.

I don't know if you know, but in the comments on that blog post "Anykey"
describes a way to get this working. Do you know if the solution that
he's talking about involves getting a "physical" managed switch that has
the monitoring port capability (it wasn't clear from what he/she said).

Thanks again,
Jim


Robert Comer wrote:

>AHH! Ok, thanks for the link.

No prob.
No, sorry, I've never tried that myself.

--
Bob Comer


On Thu, 30 Apr 2009 15:52:32 -0400, ohaya <ohaya@xxxxxx> wrote:

Bob,

Ok, thanks anyway.

Jim



Robert Comer wrote: