Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for something fairly simple to install, that will monitor network traffic on the vswitch for my esxi node as we're getting ddosed and I need to be able to easily see where the traffic is coming from.

share|improve this question

On the actual vSwitch? Well you can't as far as I know that's a limitation of the in-built vSwitch, you can with Cisco's Nexus V1000 alternative virtual switch replacement but not with the regular one.

To be honest you should really be dealing with things like DOS issues before it hits your ESX boxes, via a router/firewall/LB etc. These will obviously let you deal with their own interfaces and help you finding out where your DOS is coming from.

If the DOS is internally-sourced (i.e. one VM attacking another) then again you should be able to use the VM's own OS tool set to find that out. The in-built vSwitch does provide some diagnostics/metrics but not that many, even with the next version of code.

share|improve this answer
Allowing promiscuous mode on a vSwitch then hooking another VM to that vSwitch running tcpdump would be one option. – Shane Madden Jun 23 '11 at 16:55
@Shane, does that really work reliably? I tried it with the very first v4 release and had problems, not tried it since tbh. – Chopper3 Jun 23 '11 at 16:57
I can't say if it scales well, but it's working great for my test snort install at home. – Shane Madden Jun 23 '11 at 16:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.