I saw several posts regarding this issue, but I can't understand how it works. I’m trying to understand how to mirror traffic from one VM to another VM. Let's say the VM I want to mirror traffic to, runs tcpdump or any other network tool (e.g. snort ). I saw the Virtual network TAP is on hold for quite some time (~3-4 years?). Even if I use one of the listed Network packet brokers there, how do I mirror traffic into them from my VM (or several VMs) ? If I want a tool like tcpdump or snort to get the mirrored traffic as input, do I must have one of the listed Network packet brokers in between? Let's say I want to build a "Network packet broker" of my own. How do I test it? How do I mirror traffic into it? Please help, Thanks.

How to - Traffic Mirroring in Azure

Yogev Chaimovich 45

I saw several posts regarding this issue, but I can't understand how it works.
I’m trying to understand how to mirror traffic from one VM to another VM.

Let's say the VM I want to mirror traffic to, runs tcpdump or any other network tool (e.g. snort).

I saw the Virtual network TAP is on hold for quite some time (~3-4 years?).

Even if I use one of the listed Network packet brokers there, how do I mirror traffic into them from my VM (or several VMs) ?
If I want a tool like tcpdump or snort to get the mirrored traffic as input, do I must have one of the listed Network packet brokers in between?
Let's say I want to build a "Network packet broker" of my own. How do I test it? How do I mirror traffic into it?

Please help,
Thanks.

hossein jalilian 8,155 Reputation points

2024-08-06T22:50:45.74+00:00
Thanks for posting your question in the Microsoft Q&A forum.

Azure doesn't natively support port mirroring between VMs and the Virtual Network TAP feature you mentioned is still not generally available.

Here are some alternatives for Traffic Mirroring:

Enable NSG flow logs on the VMs you want to monitor

Use packet capture feature to capture traffic from specific VMs

Deploy a third-party NVA that supports traffic mirroring

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful
Yogev Chaimovich 45 Reputation points

2024-08-07T09:15:08.62+00:00
Thank you for your answer.

NSG - AFAIS it produces logs. I need the actual packets.

Packet capture - I need storage for that and it makes the process cumbersome.

What's a 3'rd party NVA? is it the list from here?

As I asked, how can I create such a VM and be part of that 3'rd party? How can I get the traffic and do something with it?

I'll try to ask it differently because I might not use the proper terms: is there a way for a VM to listen promiscuously on a network, in order to receive VM traffic?

Thanks
KapilAnanth-MSFT 47,201 Reputation points Microsoft Employee

2024-08-19T08:00:01.9833333+00:00
@Yogev Chaimovich ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

There is no out of the box solution to "Mirror" VM traffic in Azure.

From hossein jalilian's comment and per your observation ,

If you want actual packets, you have to do packet capture at the VM level only

or use Network Watcher's Packet Capture feature

NSG Flow Logs, and NVAs such as Azure Firewall give you the logs only, not the actual packets.

NOTE : You can also leverage Flow Trace which contains flow information, flags, and the time period when the flows were recorded. You can see full flow information such as SYN, SYN-ACK, FIN, FIN-ACK, RST, INVALID (flows).

Hope this helps.

Cheers,

Kapil

Share via

How to - Traffic Mirroring in Azure

Your answer