0

I want to achieve this: enter image description here

I have a Linux guest VM using QEMU, using directly a USB Wi-Fi stick via USB passthrough.

In the meantime, using wireshark, I want to sniff the network data from it. In my application, Linux quest may switch Wi-Fi network and I want to sniff its network traffic on whichever network is connected to.

But How I can achieve this

Improve this question

1 Answer 1

Reset to default
2

You put the orange arrow in the wrong place: there's no "network" talked on the USB link – just raw commands to the wifi device to synthesize some RF waveform.

The network packets only begin to exist in the network driver inside the Linux guest – so that's where you can sniff:

Your figure showing a USB passthrough coming from the outside, going into your "Linux Guest" box, but the orange double arrow is going from the inside of the linux guest to wireshark running on the host, not from the USB passthrough to wireshark

If you have a full wireshark installation on your host, the easiest way would probably using the sshdump remote dumping method, which you can select in the capture dialog:

screenshot of the capture dialog, highlighting the sshdump selection

You will have to have SSHd running on your guest, and you'll need a private network between your host and the guest, as well as tcpdump available in your guest. The user which you enter in the "Authentication" tab of the settings needs to have privileges to run tcpdump.

If you're developing a kernel Wifi driver, you'd do something else and attach a debugger to the guest kernel; but that would be significantly more complicated, and quite honestly expect you to be pretty trained in gdb and remote debugging already.

Improve this answer
6
  • In my case I just want to analyze some traffic from an app running upon Android X86 Box. I do not know if it is http or something else and I am trying to find out.
    – Dimitrios Desyllas
    Commented Jun 24 at 7:20
  • @DimitriosDesyllas Maybe you can consider a passthrough mode macvtap, although in that case you would need to do the WiFi association on the host side.
    – Tom Yan
    Commented Jun 24 at 7:47
  • Will this allow me to also have wifi control via Guest. App controls the wifi connections and manipulates them.
    – Dimitrios Desyllas
    Commented Jun 24 at 8:25
  • @DimitriosDesyllas No, the guest will consider it a wired connection.
    – Tom Yan
    Commented Jun 24 at 8:39
  • So I'll hafta build and run tcpdump upon android also I need SSHd upon android as well.
    – Dimitrios Desyllas
    Commented Jun 24 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .