Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Monitoring network traffic from within a virtual machine on a VMware vSphere ESX/ESXi server (1038847)

Last Updated: 3/20/2024Categories: Best PracticesTotal Views: 16764Language:
Chinese (Simplified)JapaneseEnglish

6 like this article

Subscribe to get an email
newsletter with new updates

6 people found this helpful Please provide article feedback:

Symptoms

monitor-network-traffic

Purpose

Software within a virtual machine can be used to monitor or capture network traffic passing through a vSwitch Portgroup on the same ESX/ESXi host. Traffic may be limited to the traffic intended for other virtual machines on the same host, or come from a mirrored port on an upstream physical switch.

Configuration and the usage of the third-party monitoring software within a virtual machine, or upstream switch configuration, is outside the scope of this article.

Resolution

Capturing and monitoring of network traffic using third-party monitoring software within a virtual machine is only possible if the network traffic is made available to that virtual machine.

The default security policy for VMware vSphere virtual machines denies the usage of promiscuous mode to capture traffic on a vSwitch portgroup. Traffic that is not addressed to the monitoring virtual machine's network interface's MAC address is not be received or captured by the virtual machine or the third-party monitoring software. For more information, see How promiscuous mode works at the virtual switch and portgroup levels (1002934) and Advanced Networking in the Basic System Administration guide for your version of ESX/ESXi.

To capture or monitor network traffic exposed to the ESX/ESXi host on a specific portgroup:

Configure the vSwitch and the portgroup to allow virtual machines to use promiscuous mode. For more information, see Configuring promiscuous mode on a virtual switch or portgroup (1004099).

Deploy a virtual machine with the third-party monitoring or packet-capturing software.

Attach the virtual machine's virtual network interface to the monitoring portgroup. For more information, see Virtual Machine Configuration in the Basic System Administration guide for your version of ESX/ESXi.

Configure the third-party software to capture traffic on the corresponding interface.

To capture or monitor network traffic external to the ESX/ESXi host, additionally:

Consider creating a dedicated vSwitch and portgroup for monitoring.

Optionally configure the portrgroup to limit traffic to a specific VLAN to be monitored. For more information, see Sample configuration of virtual switch VLAN tagging (VST Mode) (1004074) and Virtual Switch VLAN Tagging (VST) mode on a vNetwork Distributed Switch (1010778).

Configure an upstream physical switch port to span or mirror desired traffic, such as a specific VLAN, or traffic matching given MAC address range, to a physical uplink NIC on the ESX/ESXi host.

Attach the upstream NIC to a vSwitch and portgroup to be used for monitoring.

Related Information

When a virtual machine attempts to utilize promiscuous mode in violation of the defined vSwitch and Portgroup security policy, the attempt is denied and logged by the ESX/ESXi host. For more information, see Identifying virtual machines attempting to use promiscuous network mode on ESX/ESXi (1023341).
How promiscuous mode works at the virtual switch and portgroup levels
Sample configuration of virtual switch VLAN tagging (VST Mode)
Configuring promiscuous mode on a virtual switch or portgroup
Identifying virtual machines attempting to use promiscuous network mode on ESX/ESXi
VMware vSphere ESX/ESXi Server 上の仮想マシン内のネットワーク トラフィックを監視する
在 VMware vSphere ESX/ESXi Server 上从虚拟机中监控网络流量

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware VirtualCenter

VMware vCenter Server

VMware ESX Server

Related Versions:

VMware VirtualCenter 2.5.x

VMware vCenter Server 4.1.x

VMware vCenter Server 4.0.x

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESXi 4.0.x Installable

VMware ESXi 4.0.x Embedded

VMware ESXi 3.5.x Installable

VMware ESXi 3.5.x Embedded

VMware ESX Server 3.5.x

VMware ESX Server 3.0.x

VMware ESX 4.1.x

VMware ESX 4.0.x

view all

Take Our Survey

Support Assistant