Documentation Center
AlienVault® USM Anywhere™

Configuring Windows Server 2012+ Hyper-V Virtual Machines for Port Mirroring

Complete the two following tasks to set up port mirroring on a Windows Server 2012 R2 Hyper-V host.

Important: Before you configure port mirroring on a Windows Server 2012 VM, make sure that the Microsoft packet sniffing tool hotfix is applied.

Configuring the Virtual Machine to Capture Mirrored Traffic

To configure the virtual machine you want to use to capture mirrored traffic

  1. Open the Hyper-V Manager and right-click the machine that you want to use to capture mirrored traffic.
  2. Select Settings.
  3. Expand the associated network adapter and select Advanced Features.
  4. Scroll to the Port mirroring section and set the Mirroring mode to Destination.

    Configuring the virtual machine to capture mirrored traffic

  5. Click Apply and OK.

Configuring the Mirror Port

To configure the mirror port

  1. Open the Windows PowerShell console.
  2. Enter
  3. $a = Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28-951f524251b5

     

    $a.SettingData.MonitorMode = 2

     

    add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <virtual_switch_name> -VMSwitchExtensionFeature $a

Important: Be aware that, if you enable promiscuous mode for a physical port, it directs all the traffic received on that port towards the virtual machine destination.

To learn more about configuring port mirroring on a Hyper-V virtual machine, refer to this article on the Microsoft website.

Related Video Content

To view other related training videos, click here.