View traffic going from/to an appvm? or going through the sys-firewall?

[Stumpy]

I posted earlier about trying to limit traffic on some appvms and got
some helpful feedback about specific services but I am now thinking it
would be most useful to just see traffic leaving a appvm and then adding
rules based on that. problem is, i don't know how to view appvm network
traffic. Is there a command I could use or a log that I could look over
to help me with this? I would like to do this in both my fedora and deb
based vms.

[Steve Coleman]

I have a hack you might be interested in. It does not show you the
traffic but it will show you what is denied by the firewall, via
capturing the ICMP denied messages.

For some special VM's (email, boinc, untrusted, etc) where I want to
lock it down to just the essential services, I run this in a mode where
it echos the appropriate "qvm-firewall <VM> -add <hostip>/16" to the
console, where I will pick and choose to cut and paste the commands I
want to run into another dom0 terminal window. Once pasted you can edit
the command to refine how you want it to permit hosts or netblocks. The
default is /16 since the firewall is limited in how many entries it will
allow. Yes, its a hack, and it would not be safe to allow everything it
presents, but it works well enough for me.

> qvm-fwdenied -A -C 10 <vmname>

It is run from dom0 where it launches a tcpdump in the VM you are
interested in, and will capture -C <N> packets and then return. It
collects N packets and returns to process them, so it can miss packets
when it is not in tcpdump mode. If an ICMP denied event occurs it will
compose the qvm-firewall command to permit that host, but it will not
run it for you. You need to decide what is permitted.

I generally run it to investigate why an application is not working
correctly in an intentionally locked down VM, as this is generally
faster than launching wireshark and collecting/filtering the traffic
flow. If what you really want is to just see the traffic flow then open
wireshark in the same way and let it run. If your goal is to simply
manage what the VM connects to then you might be able to hack my script
to get what you want.