Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Cannot Live-capture VirtualBox network packets with Wireshark

From: Alexey Eromenko <al4321@xxxxxxxxx>
Date: Mon, 6 Jun 2011 19:41:34 +0300
Hi All !

Host: Debian Linux 6.0, x64. VBox 4.0.51 (and stable 4.0.x series).
Wireshark 1.6.0-rc2 (also tried stable 1.2.x series)

VirtualBox set with traffic capture:
$ VBoxManage modifyvm "my VM" --nictrace1 on
$ VBoxManage modifyvm "my VM" --nictracefile1 /tmp/mydata.cap

The live capture command is this one:
$ tail -c +0b /tmp/mydata.cap | wireshark -k -i -

But when I separate those into 2 commands, it works:
$ tail -c +0b /tmp/mydata.cap > /tmp/123.cap
$ wireshark /tmp/123.cap

Such problem doesn't exist with other emulators (Dynamips), so with
Dynamips I can enjoy live traffic updates.
I don't know who to blame in this case.

Any ideas?
--
-Alexey Eromenko "Technologov"