1

I have 2 physical machines, A and B. A runs VMWare Workstation with a virtual machine C. C is using Bridged network interface.

A and B are both connected via ethernet to a switch. B has two NIC's. If I used port mirroring on A's connection to the switch, and then put that into B, would I be able to capture traffic between A and C? Does that traffic go to the switch, or does it get short circuited somehow?

Thanks in advance!

Improve this question
3
  • @sysadmin1138. What about VM to VM traffic on the same host? I simplified the example a little bit. Actually A has 2 VM's, C and D. I want to know if I can capture packets from C to D with B. The VM set up is a test environment. In deployment, C and D are actually physical machines and there is no A.
    – engineerchuan
    Nov 2, 2011 at 11:54
  • I'm not sure about workstation, actually. I suspect that functionality is not present because of how the software bridge works, but it could be wrong.
    – sysadmin1138 ♦
    Nov 2, 2011 at 11:57
  • I think I'm kinda getting on the right track and can do research myself. Thanks. link, link
    – engineerchuan
    Nov 2, 2011 at 11:58

1 Answer 1

Reset to default
2

VMware Workstation network traffic does indeed short-circuit inside of the host machine. Traffic from VMs on that machine to the host itself will never hit that Ethernet switch. It's a kind of virtual switch inside the Host, so traffic that can be handled locally will be handled locally; no need to forward it to the switch in the closet.

In order to capture that traffic, the capture has to be performed on the host itself. I do this frequently when checking on things like startup-traffic for a VM.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .