ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual Server 2005

Recent Virtual Server 2005 posts

* Need help on hosting
* Futur of Hyper V
* SCVMM 2008
* highly VM with pass-through disks
* VM"s can"t ping
* Virtual Server & processor allocation
* virtual machines and processor allocation
* Shutdown guest OS problem
* P2V bizarre?
* I cannot add a physical switch between Win Server 2008 and corp Ne
* Blotting VHD
* Virtual Disk not available
* pass-through disk
* Network\IP\Port80
* Datacenter Edition - How to activate OS in VM - Free Licences?
* Can"t read physical CD without rebooting host
* Virtual Server on a cluster
* Network adapter will not load correctly
* How to P2V Windows 2000 Server
* Hyper-V CPU performance

Add Solution

Bridging all traffic from physical adapter to virtual adapter

Source: microsoft.public.virtualserver
Sent: 11/04/2008
From: JimS
Message:

Let me start by saying that I can do this with Vmware, but want to use Hyper-v.

I have mirrored several ports on my switch and I have connected a second
adapter on my hyper-v server to the monitor port on my switch. When I run
Wireshark (sniffer), and connect to the adapter on the hyper-v server that is
plugged into the monitor port on my switch, I am able to see all the traffic
from the ports of the switch that are being mirrored.

What I would like to do is run wireshark in a vm and get all the traffic on
the physical adapter that is hooked up to the monitor port of the switch. I
have tried a couple of ways to try to get the traffic.

1) I tried assigning in Virtual Network Manager the virtual adapter to the
external adapter that is connected to the monitor port on the switch.
2) I tried creating an Internal network in Virtual Network Manager. I then
assign the virtual adapter to the Internal network that I created. Then on
the Host computer, I bridge the physical sniffer adapter to the Internal
network.

Either way, I only seem to be seeing the broadcast packets that come across
the sniffer adapter, and none of the routed ones that I can see when I have
wireshark on the physical adapter.

Any suggestions on how I could have a virtual computer have a virutal
adapter that gets all of the packets that come into the physical adapter and
not just the ones that are routed to the vm or broadcast? If I can see all
network traffic on the physical adapter, I would expect if I bridged the
physical adapter to the virtual adapter, that the virtual adapter should get
all the network traffic sent to the physical adapter because it is just
bridging, not routing it.

Post Reply | This is Spam! | Mark as Spam

Related Messages

RE: Bridging all traffic from physical adapter to virtual adapter

Sent: 11/04/2008
From: JimS
Message:

Maybe I can make this clearer. I have mirrored ports on my switch to a
monitor port. on the switch The monitor port is connected to my Windows
Server 2008 Hyper V server on an adapter I will call "sniffer". When I run
wireshark on the server, I can see all the network traffic of my network.

What I would like to do is to run wireshark on a vm running on the Hyper-V
server. And then map the virtual adapter to the physical "sniffer" adapter.
Then I would be able to capture all the network traffic of my network from
within the vm.

I can get this to work very easily using vmware virtual server 1.0/2.0, but
want to do it with Hyper-v instead.

"JimS" wrote:

Show quoted text

> Let me start by saying that I can do this with Vmware, but want to use Hyper-v.
>
> I have mirrored several ports on my switch and I have connected a second
> adapter on my hyper-v server to the monitor port on my switch. When I run
> Wireshark (sniffer), and connect to the adapter on the hyper-v server that is
> plugged into the monitor port on my switch, I am able to see all the traffic
> from the ports of the switch that are being mirrored.
>
> What I would like to do is run wireshark in a vm and get all the traffic on
> the physical adapter that is hooked up to the monitor port of the switch. I
> have tried a couple of ways to try to get the traffic.
>
> 1) I tried assigning in Virtual Network Manager the virtual adapter to the
> external adapter that is connected to the monitor port on the switch.
> 2) I tried creating an Internal network in Virtual Network Manager. I then
> assign the virtual adapter to the Internal network that I created. Then on
> the Host computer, I bridge the physical sniffer adapter to the Internal
> network.
>
> Either way, I only seem to be seeing the broadcast packets that come across
> the sniffer adapter, and none of the routed ones that I can see when I have
> wireshark on the physical adapter.
>
> Any suggestions on how I could have a virtual computer have a virutal
> adapter that gets all of the packets that come into the physical adapter and
> not just the ones that are routed to the vm or broadcast? If I can see all
> network traffic on the physical adapter, I would expect if I bridged the
> physical adapter to the virtual adapter, that the virtual adapter should get
> all the network traffic sent to the physical adapter because it is just
> bridging, not routing it.

RE: Bridging all traffic from physical adapter to virtual adapter

Sent: 11/04/2008
From: JimS
Message:

So now I think I know what is going on. I need to get the virtual adapter to
go into promiscuous mode. It looks like there was an xml entry in Virtual
Server 2005 R2 SP1 that allowed this, but I have no idea how to set this in
Hyper-V

"JimS" wrote:

Show quoted text

> Maybe I can make this clearer. I have mirrored ports on my switch to a
> monitor port. on the switch The monitor port is connected to my Windows
> Server 2008 Hyper V server on an adapter I will call "sniffer". When I run
> wireshark on the server, I can see all the network traffic of my network.
>
> What I would like to do is to run wireshark on a vm running on the Hyper-V
> server. And then map the virtual adapter to the physical "sniffer" adapter.
> Then I would be able to capture all the network traffic of my network from
> within the vm.
>
> I can get this to work very easily using vmware virtual server 1.0/2.0, but
> want to do it with Hyper-v instead.
>
> "JimS" wrote:
>
> > Let me start by saying that I can do this with Vmware, but want to use Hyper-v.
> >
> > I have mirrored several ports on my switch and I have connected a second
> > adapter on my hyper-v server to the monitor port on my switch. When I run
> > Wireshark (sniffer), and connect to the adapter on the hyper-v server that is
> > plugged into the monitor port on my switch, I am able to see all the traffic
> > from the ports of the switch that are being mirrored.
> >
> > What I would like to do is run wireshark in a vm and get all the traffic on
> > the physical adapter that is hooked up to the monitor port of the switch. I
> > have tried a couple of ways to try to get the traffic.
> >
> > 1) I tried assigning in Virtual Network Manager the virtual adapter to the
> > external adapter that is connected to the monitor port on the switch.
> > 2) I tried creating an Internal network in Virtual Network Manager. I then
> > assign the virtual adapter to the Internal network that I created. Then on
> > the Host computer, I bridge the physical sniffer adapter to the Internal
> > network.
> >
> > Either way, I only seem to be seeing the broadcast packets that come across
> > the sniffer adapter, and none of the routed ones that I can see when I have
> > wireshark on the physical adapter.
> >
> > Any suggestions on how I could have a virtual computer have a virutal
> > adapter that gets all of the packets that come into the physical adapter and
> > not just the ones that are routed to the vm or broadcast? If I can see all
> > network traffic on the physical adapter, I would expect if I bridged the
> > physical adapter to the virtual adapter, that the virtual adapter should get
> > all the network traffic sent to the physical adapter because it is just
> > bridging, not routing it.

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: