Sorry for a double upload... I have this plan to show the scammer his location and IP, something like what Lewis' Tech did. However I couldn't seem to connect VMware to Wireshark. I couldn't find vmnet8 or 1.
What interfaces (VMnet1, VMnet8, etc.) do you see if you go to Edit > Virtual Network Editor in VMWare? Is your virtual machine set to NAT?
etnguyen03 I see vmnet 8 and 1 and yes my vm is set to NAT
heinekenprince Can you take a screenshot of the "Virtual Network Editor" page? Can you try starting Wireshark as administrator?
etnguyen03 I tried launching Wireshark as admin. That didn’t help either :( I’ll send u the screenshot later today as I’m busy rn.
heinekenprince In Wireshark, have you selected "All Interfaces" by the Capture Filter box? Does VMnet8 appear in the "Network Connections" control panel window (Network and Sharing Center > Change Adapter Settings)?
etnguyen03 I managed to get it working. Thanks for your suggestions!
etnguyen03 i have a question. Can i grab the IP of the scammer if they are using Citrix Gotoassist? If so, how? Coz i saw it kept jumping around different ips and it was really confusing.
heinekenprince No, the connection passes through Citrix's VPN/server/whatever first. Citrix's IP is what you see in Wireshark.
etnguyen03 oh ok. But if they use TeamViewer or LogMeIn it would work. I see. Thanks for helping!