I'm setting up a test network with qemu and vde. I would like to be able
to sniff traffic by running tcpdump on the host machine, by attaching
tcpdump to one of the ports of an emulated vde_switch. (I'll configure
vde_switch it to act as hub rather thna a switch if that's needed; not
sure if there are other ways, like a second attach to port I'm really
interested in, or some port-replication feature as found in some other

I'd prefer to not have to route packets via some real network interfaces
on the host computer, just to be able to sniff it.

I've been searching for tools to do this, but I couldn't find anything.
Ideally, I'd like to use something like vde_plug the-hub | tcpdump -r -,
but vde_plug and tcpdump don't use the same format.

I have looked briefly at the vde_pcapplug source code, but it appears it
doesn't support pcap savefiles. I imagine it wouldn't be very hard to
extend vde_pcapplug to be able to read and/or write pcap files, instead
of working with a real network interface. But before I try that, I'd
like to know if there's any other tool I should be using instead?


Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.

vde-users mailing list

Reply via email to