0

I have one Linux machine that have 2 interfaces. The first one is used as a default one and provides access to internet, the second interface was added as a dedicated link to send packets from tcpgen so it can be captured on different machine (PC2). What is the simplest way for all traffic that is sent by tcpreplay tool to dedicated interface of PC1 (eth1) to be forwarded to PC2. PC2 (Windows machine) has similar configuration - one dedicated interface for capturing traffic from PC1 and another interface used for the internet.

AboutNothing
  • 1
  • 1
  • Insufficient information. if you are using the "--intf1=eth1" on tcpreplay all of the data will go to PC2 unless something in between (network switch) is filtering the traffic. Use a cross over cable to directly connect the machines, or put PC2 on a "mirrored" switch port. – mfarver Dec 03 '13 at 20:34
  • Thanks for response. Both machines are virtual, I am using Hyper-V as host system. Both machines use external network adapter(10.140.60.x/24) + one private virtual adapter(10.140.50.x/24), I can ping both addresses without any problems. Still, when running command "tcpreplay -i eth1 /home/pcaps/pcap1.pcap" I don't receive it on any interface on PC2. I also tried to send the traffic through "eth0". The firewall is disabled. Likely it's something wrong with Hyper-V networking setup, I will try to fiddle with that. – AboutNothing Dec 04 '13 at 18:27

1 Answers1

0

Sounds like you need to enable port mirroring on the HyperV virtual switch, that way machine two will receive all of the traffic from machine 1. This article should help: http://workinghardinit.wordpress.com/2013/02/01/exploring-hyper-v-virtual-switch-port-mirroring/

I don't have a way to test but it is rumored there is an undocumented way to make this work on 2008. Look at the VM XML configuration file of machine 2 to figure out the switch and port name then try setting this reg key to 1: HKLM\SYSTEM\CurrentControlSet\services\VMSMP\Parameters\SwitchList\<SwitchName>\<PortName>\MonitorMode

mfarver
  • 2,576
  • 14
  • 16
  • Thanks, I have read the article and also tried to find more information. Unfortunately, I use server 2008 R2 that doesn't support it. At least I know that the issue is with hyper-v networking which use virtual switch (not hub that would allow promiscuous traffic). – AboutNothing Dec 04 '13 at 20:09
  • HKLM\SYSTEM\CurrentControlSet\services\VMSMP\Parameters\SwitchList\\\MonitorMode = 1 – mfarver Dec 05 '13 at 15:08