Mac – How to capture other computers traffic in Wireshark on a WiFi-network

If you are not connected via ethernet to you home router, most likely that home router than the home router uses a switch for its LAN ports and not a hub, thus each port has its own collision domain, whereas in a hub the collision domain is shared among all the ports and you would see all traffic on every port.

If you are connected wirelessly, there may be a few issues. First, certain wireless cards' drivers do not support being put into promiscous mode. Nothing can be done about that unless you want to write your own. Second, if your network is encrypted and you are only seeing layer 2 traffic from various sources and not the higher layer protocols expected (which doesn't appear to be the case), then you must enter the WEP key into wireshark so it can handle the decryption. WPA and WPA2 decryption get more complicated, as older versions of wireshark do not support it, and if it is supported, then you must capture the entire handshake taking place between the router and the device (EAPOL packets), as unique keys are generated between the device and router.

Apparently, VirtualBox itself can write all packets to or from a guest to a pcap file, so that might be one way to do this.

In Wes Morgan's answer to a similar VirtualBox question, he says that bridged mode is "bypassing the host OS network stack entirely", which may mean that packets between the host and guest aren't seen by BPF on OS X and thus aren't available to Wireshark (which uses libpcap, which uses BPF on OS X).