up vote 1 down vote favorite
share [g+] share [fb]

I have 2 physical machines, A and B. A runs VMWare Workstation with a virtual machine C. C is using Bridged network interface.

A and B are both connected via ethernet to a switch. B has two NIC's. If I used port mirroring on A's connection to the switch, and then put that into B, would I be able to capture traffic between A and C? Does that traffic go to the switch, or does it get short circuited somehow?

Thanks in advance!

link|improve this question
77% accept rate
@sysadmin1138. What about VM to VM traffic on the same host? I simplified the example a little bit. Actually A has 2 VM's, C and D. I want to know if I can capture packets from C to D with B. The VM set up is a test environment. In deployment, C and D are actually physical machines and there is no A. – engineerchuan Nov 2 '11 at 11:54
I'm not sure about workstation, actually. I suspect that functionality is not present because of how the software bridge works, but it could be wrong. – sysadmin1138♦ Nov 2 '11 at 11:57
I think I'm kinda getting on the right track and can do research myself. Thanks. link, link – engineerchuan Nov 2 '11 at 11:58
feedback

1 Answer

up vote 2 down vote accepted

VMware Workstation network traffic does indeed short-circuit inside of the host machine. Traffic from VMs on that machine to the host itself will never hit that Ethernet switch. It's a kind of virtual switch inside the Host, so traffic that can be handled locally will be handled locally; no need to forward it to the switch in the closet.

In order to capture that traffic, the capture has to be performed on the host itself. I do this frequently when checking on things like startup-traffic for a VM.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.