VMWare ESXi 5.1: setup port mirroring for vm

janhoedt
janhoedt used Ask the Experts™
on
Hi,

I'd need to capture traffic from a vmware machine on ESXi 5.1 which has no full os loaded (winpe), therefore I'd like to setup another machine with windows and run netmon on it.

Please advise howto do this.

J.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017
Commented:
We would normally start by using Winshark connected to the same vSwitch as VM you need to monitor and then set the port group and switch for promiscuous mode.

All traffic on vSwitch can then be sniffed then using a MAC address filter you should be able to capture traffic to your VM.
Blogger
Commented:
Follow the below Official KB Articles which tell you what steps to be taken care of to sniff traffic from other vM's
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1000880
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1038847

You will get a lot of software which can be used to do the sniffing.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial