Capture traffic from SPAN and send it to a HyperV VM

Posted by Josh Brower on Server Fault See other posts from Server Fault or by Josh Brower
Published on 2011-01-06T05:21:18Z Indexed on 2011/01/06 6:55 UTC
Read the original article Hit count: 513

Filed under:

hyper-v

|

packet-capture

|

span

On a Server 2008 SP2 HyperV VM, I am trying to capture traffic from a SPAN.

I know the SPAN is working, as I am able to capture the traffic on the Host OS, but when I try and capture traffic on the VM, with the SPAN being sent to a virtual adapter, I cannot seem to get it to work--

After doing some Googling, I have found that it might be because HyperV NICs cannot be put into promiscuous mode. (?)

Any other thoughts?

-Josh

© Server Fault or respective owner

Related posts about hyper-v

HyperV on Domain Controller or DC on HyperV?

as seen on Server Fault - Search for 'Server Fault'
I want to setup a little fileserver/domain controller/sharepoint server. SharePoint shouldn't run on the DC directly, so I want to use HyperV. But I never used it before, so I wonder: Should I install the Domain Controller and HyperV Role and run 1 VM for SharePoint? Or should I run HyperV server… >>> More
Hyper-V and Hyper-threading: On or off?

as seen on Server Fault - Search for 'Server Fault'
Hey all, With the new Xeon CPUs supporting Hyper-threading, what is the current wisdom with regard to using it (or not) on a Hyper-V host machine? I was originally under the impression that turning it on in a virtual host environment could be detrimental as the 'extra' CPUs were not true cores.… >>> More
Migration of VM from Hyper-V to Hyper-V R2 - Pass through disks

as seen on Server Fault - Search for 'Server Fault'
I am trying to migrate a VM which is using two pass through disks from a legacy Hyper-V Cluster to a new R2 cluster. The migrated VM cannot use the pass through disks though. The guest OS (2008 R2) doesn't seem to like the disk and eventually tries to format the disk instead of mounting it. The… >>> More
Comparison of Hyper-V, Hyper-V Server, VMware ESXi, Xen and Parallels Bare Metal (Community Wiki)

as seen on Server Fault - Search for 'Server Fault'
Can we use this question to collect information and the pros and cons of each of the above products? Specifically I am wondering whethere there is any sane reason to use Hyper-V (the role built into Windows Server) over Hyper-V server (the stand-alone product based on the same technology) and what… >>> More
Hyper-V Deployment Options Best Practices

as seen on Server Fault - Search for 'Server Fault'
In what circumstances would you choose each of the following deployment options: Hyper-V installed as the bare bones Windows Hyper-V Server 2008 R2 Hyper-V role installed on a Windows Server 2008 R2 Server Core installation Hyper-V role installed on a Windows Server 2008 R2 Full Installation For… >>> More

Related posts about packet-capture

SharpPcap - A Packet Capture retring seding messesge problem.

as seen on Stack Overflow - Search for 'Stack Overflow'
I trying to capture packets using SharpPcap library. I'm able to return the packets details but I'm having problem to get what the message content inside the packet. the packet using .Data to return the message and when I use it it is returning (System.Byte[]). here is the library website: http://www… >>> More
SharpPcap - A Packet Capture getting messesge problem.

as seen on Stack Overflow - Search for 'Stack Overflow'
I trying to capture packets using SharpPcap library. I'm able to return the packets details but I'm having problem to get what the message content inside the packet. the packet using .Data to return the message and when I use it it is returning (System.Byte[]). here is the library website: http://www… >>> More
Which Packet Capture Format is better?

as seen on Stack Overflow - Search for 'Stack Overflow'
I am writing an application to save the captured IP packets to file. Which of the following packet capture format is better suited for use as the file format? Click on the link for more information on each. Snoop (rfc1761) PCAP In addition, is there a C# library for any of the above format? >>> More
raw h.264 packet capture and playing in VLC

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I am capturing packets off the network from a video conference HDX. The video is sent in RTP and is encoded in H264. I am trying to capture these packets and generate a video file. I wrote raw H264 data from the packets to disk and i am trying to play it in VLC. VLC just shows a green box. Am… >>> More
Video packet capture over multiple IP cameras

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello We are working on a C language application which is simple RTSP/RTP client to record video from Axis a number of Cameras . We launch a pthread for each of the camera which establishes the RTP session and begins to record the packets captured suing the recvfrom() call... A single camera single… >>> More