In QEMU, is it possible to intercept packets being sent/received by the Linux Guest OS?
In addition to @usr57368 answer -For devices created with ’-netdev’, use ’-object filter-dump,...’ instead -net dump:
-object filter-dump,id=id,netdev=dev,file=filename][,maxlen=len]Dump the network traffic on netdev dev to the file specified by filename. At most len bytes (64k by default) per packet are stored. The file format is libpcap, so it can be analyzed with tools such as tcpdump or Wireshark.
From the QEMU documentation:
-net dump[,vlan=n][,file=file][,len=len]Dump network traffic on VLAN n to file file (
qemu-vlan0.pcapby default). At most len bytes (64k by default) per packet are stored. The file format is libpcap, so it can be analyzed with tools such as tcpdump or Wireshark.
You should also be able to monitor in real-time by running Wireshark on the host if you --net tap.
Since qemu is open source, you can get the source and insert code into the network device emulation to capture and log the data packets as they come through the device. For example, see the virtio_net_flush_tx() routine in hw/virtio-net.c.