Solved

vmware port

Posted on 2013-11-19
7
368 Views
Last Modified: 2013-12-04
I have a virtual server and I'd like to capture traffic going to that virtual server. How do I span the port on my Cisco switch. I am not onsite so I do not know the port where the physical server is connected to. Any ideas? Thx
0
Comment
Question by:leblanc
  • 3
  • 2
  • 2
7 Comments
 
LVL 12

Assisted Solution

by:Infamus
Infamus earned 166 total points
ID: 39661035
Do you have access to the server, for example, like RDP?

If you can, then you can install wireshark and capture the traffic, otherwise you need to find a switchport where the vm host is connected.  In that case, you will be capturing all the traffic going to the vm host.
0
 
LVL 1

Author Comment

by:leblanc
ID: 39661152
Is it possible to capture the port where the virtual server is connected to? I am not sure how that will work?
0
 
LVL 57

Accepted Solution

by:
giltjr earned 334 total points
ID: 39661284
You need to find the MAC address of the physical server and then look at the mac address table.

However, how/where are you going to SPAN the traffic if you don't have physical access to the switch?

Just to make sure if you do span the port you will capture ALL traffic to that physical server, not just the traffic to that VM.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 1

Author Comment

by:leblanc
ID: 39661349
This is what I have:
- I can access the switch
- I know the MAC and IP address of the physical server where the virtual server resides.
- I know the switch port where the physical server is connected to.
- I know the MAC address of the virtual server.

I just want to capture the traffic to the virtual server, not the whole physical server. It has to have a way to do this. Thx
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 334 total points
ID: 39661359
Span session only know ports.  So all traffic going in/out of the port is mirrored.

If you have the correct access to the ESXi host you can capture traffic there using TCPDUMP.


http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1031186

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1000880
0
 
LVL 1

Author Comment

by:leblanc
ID: 39662825
I am not allow to have access to the ESXi host... Politics... :)
I will just capture the port where the physical server is connected to and setup the filter on the virtual server. Thx
0
 
LVL 12

Expert Comment

by:Infamus
ID: 39662842
Let us know how it went.
Good luck.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question