virtual machine sees. This feature is built into QEMU and works with any
emulated network card and any host network device except vhost-net.
It's relatively easy to use tcpdump(8) with tap networking. First the
tap device for the particular VM needs to be identified and then packets can be
# tcpdump -i vnet0 -s0 -w /tmp/vm0.pcap
The tcpdump(8) approach cannot be easily used with non-tap host network devices, including slirp and socket.
Using the dump net clientPacket capture is built into QEMU and can be done without tcpdump(8). There are some restrictions:
- The vhost-net host network device is not supported because traffic does not cross QEMU so interception is not possible.
- The old-style -net command-line option must be used instead of -netdev because the dump net client depends on the mis-named "vlan" feature (essentially a virtual network hub).
$ qemu -net nic,model=e1000 -net dump,file=/tmp/vm0.pcap -net userThis presents the VM with an Intel e1000 network card using QEMU's userspace network stack (slirp). The packet capture will be written to /tmp/vm0.pcap. After shutting down the VM, either inspect the packet capture on the command-line:
$ /usr/sbin/tcpdump -nr /tmp/vm0.pcap
Or open the pcap file with Wireshark.