Hyper-V host mac address show in packet capture for the virtual machine

Question

Hyper-V host mac address show in packet capture for the virtual machine

Minh Tuan Nguyen 40

We have hyper-v host with MAC Address 50-7c-6f-61-82-82 and the virtual machine with 00-15-5d-ac-03-21
Some times we have issue with the application on the VM. In the packet capture, we can see the MAC address of the host in the communication flow for the IP of the virtual machine as the picture

The VM has MAC address in dynamic mode and VSwitch has dynamic as teaming algorithm.
Is this a normal behavior of hyper-V?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello Minh Tuan Nguyen,

The packet capture behavior you are observing is entirely normal and expected by design. When a Hyper-V virtual switch utilizes the Dynamic teaming algorithm, it distributes outbound traffic flowlets across multiple active physical network adapters to maximize aggregate bandwidth. To prevent upstream physical switches from registering the same virtual machine MAC address on multiple switch ports simultaneously, which triggers MAC flapping and topology instability, the Hyper-V networking stack automatically overwrites the source MAC address of packets traversing non-affinitized physical adapters with the physical MAC address of that specific transmitting host NIC. Traffic traversing the virtual machine's primary affinitized adapter retains the original virtual MAC address.

While this routing logic optimizes throughput, strict upstream network security policies such as Dynamic ARP Inspection (DAI), IP Source Guard, or MAC limiting often flag this expected substitution as ARP spoofing and silently drop the packets, causing intermittent application timeouts. To resolve this without modifying upstream switch security configurations, you must change the vSwitch load balancing algorithm to Hyper-V Port. This setting pins the virtual network adapter to a single physical host adapter, thereby completely disabling flowlet distribution and MAC address rewriting. Could you please specify your Windows Server version and whether this vSwitch is backed by SET or LBFO so that the appropriate Set-VMSwitch or Set-NetLbfoTeam cmdlets can be verified for your environment?

Hope you found something useful in the answer. If it helped you get more insight into the issue, please consider accepting it. Thank you and have a nice day!

VP

Minh Tuan Nguyen 40 Reputation points

2026-02-20T09:33:57.5233333+00:00

Hi @VPHAN

Thank you for your detailed explanation.
We are running Windows 2022 and using Switch Independent Teaming for the vSwitch

Tuan
VPHAN 43,155 Reputation points Independent Advisor

2026-02-20T09:49:48.0833333+00:00

Because you are running Windows Server 2022, Switch Embedded Teaming is the recommended standard architecture, as legacy LBFO teaming is deprecated when bound to Hyper-V virtual switches . To resolve the intermittent application timeouts caused by upstream security appliances dropping these modified packets, you must change the load balancing algorithm to Hyper-V Port. You can apply this configuration immediately via an elevated PowerShell session using the command Set-VMSwitchTeam -Name "YourVirtualSwitchName" -LoadBalancingAlgorithm HyperVPort. This explicitly binds the virtual machine's virtual network adapter to a single physical port, bypassing flowlet distribution and ensuring the virtual machine's original MAC address remains strictly intact across all transmitted packets. If your environment still utilizes the deprecated LBFO teaming instead of SET, you would instead execute Set-NetLbfoTeam -Name "YourTeamName" -LoadBalancingAlgorithm HyperVPort. Verify your exact virtual switch name utilizing the Get-VMSwitch cmdlet before executing the modification.