1

I have mirrored a port from Netgear switch to my VM on vsphere. I cannot see requests when using tcpdump to monitor the traffic, I only see replys.

Netgear port mirror works as i have connected a laptop directly to the port and with tcpdump it shows request and replys.

example ping using tcpdump on the vm host

tcpdump -i eth3 host ichigo.uk.domain.com
16:01:26.543729 IP janus.uk.domain.com > ichigo.uk.domain.com: ICMP echo reply, id 1, seq 13487, length 40
16:01:27.544376 IP janus.uk.domain.com > ichigo.uk.domain.com: ICMP echo reply, id 1, seq 13488, length 40
16:01:28.545339 IP janus.uk.domain.com > ichigo.uk.domain.com: ICMP echo reply, id 1, seq 13489, length 40
16:01:29.546428 IP janus.uk.domain.com > ichigo.uk.domain.com: ICMP echo reply, id 1, seq 13490, length 40
shorif2000
  • 351
  • 1
  • 8
  • 28

1 Answers1

1

Did you create a new vSwitch or portgroup for the incoming traffic? Does the VM have a dedicated interface for the tcpdump traffic?

If not, you should create one. On the vSwitch that you associate with this new interface, be sure to modify the Policy Exceptions options to "Accept".

enter image description here

ewwhite
  • 197,159
  • 92
  • 443
  • 809
  • i have already set this up and the mirrored traffic is being forwarded to the 2nd port of the VM, as i have mentioned i only see replys and no requests. – shorif2000 Sep 10 '14 at 14:57