Maybe I can make this clearer. I have mirrored ports on my switch to a
monitor port. on the switch The monitor port is connected to my Windows
Server 2008 Hyper V server on an adapter I will call "sniffer". When I run
wireshark on the server, I can see all the network traffic of my network.
What I would like to do is to run wireshark on a vm running on the Hyper-V
server. And then map the virtual adapter to the physical "sniffer" adapter.
Then I would be able to capture all the network traffic of my network from
within the vm.
I can get this to work very easily using vmware virtual server 1.0/2.0, but
want to do it with Hyper-v instead.
> Let me start by saying that I can do this with Vmware, but want to use Hyper-v.
> I have mirrored several ports on my switch and I have connected a second
> adapter on my hyper-v server to the monitor port on my switch. When I run
> Wireshark (sniffer), and connect to the adapter on the hyper-v server that is
> plugged into the monitor port on my switch, I am able to see all the traffic
> from the ports of the switch that are being mirrored.
> What I would like to do is run wireshark in a vm and get all the traffic on
> the physical adapter that is hooked up to the monitor port of the switch. I
> have tried a couple of ways to try to get the traffic.
> 1) I tried assigning in Virtual Network Manager the virtual adapter to the
> external adapter that is connected to the monitor port on the switch.
> 2) I tried creating an Internal network in Virtual Network Manager. I then
> assign the virtual adapter to the Internal network that I created. Then on
> the Host computer, I bridge the physical sniffer adapter to the Internal
> Either way, I only seem to be seeing the broadcast packets that come across
> the sniffer adapter, and none of the routed ones that I can see when I have
> wireshark on the physical adapter.
> Any suggestions on how I could have a virtual computer have a virutal
> adapter that gets all of the packets that come into the physical adapter and
> not just the ones that are routed to the vm or broadcast? If I can see all
> network traffic on the physical adapter, I would expect if I bridged the
> physical adapter to the virtual adapter, that the virtual adapter should get
> all the network traffic sent to the physical adapter because it is just
> bridging, not routing it.