Run tshark in google cloud with external ( public ) IP

Dileep K asked:

I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server.
Is there any way to get the external IP( We have a reserved public IP setup for the instance) while capturing packets in tshark.

Following is the command I tried:

sudo tshark -i eth0 -f 'host 121.120.1xx.2xx' -w /tmp/capture.pcap

My answer:

No, you can’t do that, because the external IPv4 address is not available to the virtual machine. It is translated with NAT somewhere outside the VM, so your VM does not see packets with the external IPv4 address. And you don’t need to use it anyway.

View the full question and any other answers on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.