To set the stage:

Host: Dell Server Windows Server 2019 Standard Xeon E-2660 64GB RAM Broadcom NetExtreme Gigabit Ethernet Card

Guest: Gen 1 Debian 12288 RAM (not dynamic) standard network adapters

Network Equipment: Cisco C3850s

Backstory: Implementing a new IDS from vendor which requires the sensor to have traffic mirrored into one of the network adapters. I've followed the standard instructions that you can find (anywhere, everywhere) to enable port mirroring (VM Network Adapter set to destination, VMQ Off - VMSwitch external port set to mirror mode 2).

Problem: When I create the adapter and set up port mirroring it works for a while (anywhere from 6 hours to 3 days so far) and then ceases to mirror traffic to the VMNetworkAdapter. I've confirmed that the traffic is still entering the port using wireshark on the host machine, but sniffing the interface on the Guest the traffic is not being mirrored. What blows my mind is that it functions for a while and then stops.

Has anyone run into this? Is this an expectation issue, am I expecting an unusual use to function reliably when I shouldn't?

  • For IDS most vendor want the uplink that go to your firewall to be mirrored. In most scenario I did I mirrored at the switch level. Is it possible in your case ?
    – yagmoth555
    May 15 at 17:35
  • Yes, I am mirroring the firewall port in the Cisco 3850 to the external port of the VMSwitch on the hyper-v host. I have confirmed that the traffic is arriving to the host machine NIC, but isn't being passed to the guest vm, even though configured following MS instructions. May 15 at 18:58


You must log in to answer this question.