I have a Hyper-V box that has call recording for IP phones with the following connectivity:
- PBX on an access port (native vlan 42), plugs to port 22 on switch (it has no settings for VLANs, so we set native access vlan so all its traffic is on VLAN 42).
- Phones on hybrid port (native vlan 1 for workstations, tagged 42 for phones)
- Dedicated NIC on a Hyper-V machine for guest VMs
- Dedicated NIC on a Hyper-V machine for monitoring on port 21 on switch.
- Enabled port mirroring on Hyper-V
The HP ProCurve 2610-24 switch config is below:
mirror-port 21 vlan 1 name "DEFAULT" untagged 1-17,19-21,23-28 no untagged 18,22 exit vlan 42 name "VOICE" untagged 22 tagged 1-20,23,26 exit interface 22 monitor exit
I have enabled monitoring on Hyper-V host:
- On Hyper-V host, create a new virtual switch called Monitor, this physically connects to the dedicated monitoring NIC (create a separate switch for general traffic also).
- Enable extension Microsoft NDIS Capture.
$portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureName "Ethernet Switch Port Security Settings"
$portFeature.SettingData.MonitorMode = 2
Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName Monitor -VMSwitchExtensionFeature $portFeature
- Create a new VM, add following virtual network adapters:
- NIC for general data traffic connected to guest virtual switch
- NIC for monitoring traffic connected to the monitor virtual switch
- Under the monitor virtual network adapter of the guest VM, go to
Advanced Features, and set the port mirror mode to
When I run wire-shark on the guest monitoring VM, I am only ever seeing one-way traffic coming from the PBX (source) to the phone (destination), and not from phone to PBX.
In principle, since the PBX can send/receive the untagged data (presented on port 22), this should be presented verbatim on the port monitor port as an untagged data frame (for native VLAN 42), or am i barking up the wrong tree?
I have done the same Hyper-V setup but with Cisco and had no issues there that worked OK.
Not sure if this is something i have done wrong, something with Windows, or a HP issue. Pointers much appreciated.