Security → Wireshark

will Wireshark sniff all network traffic it run it from VMware workstation?

It will sniff all traffic on a specific interface that you let it sniff on.

You will also want to check into "promiscuous mode' and read up on what it does.

Also if you have any sort of (private) VLANs, be aware what it does to any captures you try and take.

Regards

I've had some issues with it and protocol offloading. I've had to disable it to get good captures before. I never really read into the nuts and bolts of it, mostly because I don't care, but it's something to be aware of.

Is this the network the VM is connected to? If you have connected the VM to your hardware then it should, why would you think otherwise? But as Brano mentioned you have to select a specific interface though.

Just FYI
»ask.wireshark.org/questi ··· ame-host
»ask.wireshark.org/questi ··· machines
»www.petri.co.il/using-pa ··· work.htm

The 3rd link helps explain what HELLFIRE is referring to.

Edit: If you are serious and really want to research I think you would need to setup a separate computer and hook it in between the 2 devices you want to monitor, but then you might need to explain more for those experts out there to help understand what you are aiming at doing specifically to give you the feedback and or answers you are after.

so Wireshark running on the VMware virtual machine can analyze traffic on the physical network. That's what a wanted to clarify.

Yes.

I will let this good person's reply help you.

»ask.wireshark.org/questi ··· n-vmware

Yes. See the above link posted by norwegian . If the VMware is on linux you'll be using tcpdump to capture the packets which you can later load and analyze in wireshark on any other machine.

does it do anything if you are on a switch (I mean yeah, it could sniff all the packets going on all the virtual machines on a physical one)

Yes you can port mirror then on the monitoring system use wire shark to sniff.

Don't you need some sort of administrative access to the switch? Its not like a vendor can plug in a laptop in the conference room and sniff out our emails during his powerpoint?

Yes you need admin access the the managed switch.

Managed switch is one thing, why would a standard switch even have an admin panel or anything controlling over the network? I can sniff my internal network via the router's switch.

I think a little more specific clarification is needed to discuss the depth's of sniffing.

The vendor should never be exposed to anything but a guest vlan/wlan.

And the OP's question might need explaining more, as there is a yes/no type answer to the question. Yes a VM will allow sniffed traffic. Will it allow all traffic to be sniffed? Depends on the network. Hence my comment initially on what is the network we are referring to from the OP, it is too broad a comment I'd think to give an exacting reply. Call me pedantic.