Bridge network to capture connections from VM with Arch and VirtualBox

Question

Hello everyone,
what I am trying to do is capturing the connections from a VM for malware analysis. It turned out to be a little harder then I thought because I'm absolutely new to arch.
So what I thought of: Just have a normal host adapter and sniff. But it turned out that the VM does not have a dedicated adapter.
So the obvious next step would be to create one. I did that via the Host-Only-Adapter menu.
The problem is, that this is not connected to the internet as it is for the guest only. So what I thought to do was bridging it to my wls1-interface wich is connected to a WiFi.
My normal way would be:
brctl addbr capture
brctl show
brctl addif capture wls1
brctl addif capture vboxnet0
But that does not work with wls1 (it is refused to be linked to that bridge though enp0s25 works well).
The second thing I thought of was using netctl to build a bridge. This is what I put in /etc/netctl/bridge
Description="vmbridge"
Interface=br0
Connection=bridge
BindsToInterfaces=(wls1 vboxnet0)
IP=dhcp
## Ignore (R)STP and immediately activate the bridge
#SkipForwardingDelay=yes
But the command "sudo netctl start bridge" is just crashing my internet connection.
So how could I do this in the possibly best and most stable way?
Thanks for your help

Answer 1

As you have found out, you cannot create a (Ethernet) bridge with a wireless interface. That is not going to work, whether you use brctl directly, or netctl.
If you would like to setup everything quickly and do not mind capturing everything (including host traffic), then just run dumpcap/tcpdump on the wireless interface.
If you are not stuck to VBox, try QEMU. Example command:
qemu-system-x86_64 -enable-kvm -m 2G -hda disk.qcow2 -net dump,file=dump.pcap -net user -net nic,model=e1000
-enable-kvm: enable KVM virtualization acceleration (requires Intel VT-x or the AMD equivalent). Remove if your machine does not support it.
-m 2G: assign 2GB RAM
-hda disk.qcow2: disk image created with qemu-img create -f qcow2 disk.qcow2 16G (16 GB disk image)
As you need to tap on the network, let QEMU create a hub network with three devices:
-net dump,file=...: hub network with
-net user: the host connection (you could also use tap, bridge, etc. if needed)
-net nic,model=...: the guest network connection
See the manual page qemu and the wiki for further details.