VMware Port Mirroring
- Identify a spare NIC on the VMware host to consume the mirrored traffic from the physical switch. If you have a switch capable of RSPAN, you can leverage that instead of a dedicated physical NIC. Please take a look at our Cisco RSPAN documentation for more details.
- From the Configuration tab, go to Networking and then open Properties
- Inside properties, click Add to create a new virtual switch
- Select Virtual Machine as the Connection Type
- Change the name of the Network Label to something that fits the naming convention of your environment. We will use Mirror as the example.
- Ensure the information looks correct and select Finish
- Enable Promiscuous Mode by selecting Mirror and choosing Edit
- Click the Security tab and ensure Promiscuous Mode is checked and Accept is selected
- Set the VLAN ID to 4095
- After the Virtual Machine has been imported, edit settings and choose Network Adapter 2 (this maps to ens34 in the VM). Choose Mirror for the Network Connection.