Dileep K asked:
I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server.
Is there any way to get the external IP( We have a reserved public IP setup for the instance) while capturing packets in tshark.
Following is the command I tried:
sudo tshark -i eth0 -f 'host 121.120.1xx.2xx' -w /tmp/capture.pcap
No, you can’t do that, because the external IPv4 address is not available to the virtual machine. It is translated with NAT somewhere outside the VM, so your VM does not see packets with the external IPv4 address. And you don’t need to use it anyway.
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.