Hyper-V NIC in Promiscuous Mode

Question

Hello,

I have a Hyper-V server 2022 with a physical NIC on the host that connects to a PBX using a port mirror from a switch. I have set up Wireshark on the physical server and it's capturing all SIP traffic, just as it's intended to do.

The issue is that the app that needs to capture the SIP traffic is on a VM and I cannot get the VM to capture the traffic.

From the VM I can ping the physical NIC's IP, I can ping the IP address of the switch and I can ping the PBX so it's not a connectivity problem. The wireshark on the VM does capture traffic like ICMP and broadcast traffic on the VMs NIC but not the SIP traffic.

I have found lots of articles explaining how to port mirror between VMs but nothing about how to capture packets on a physical adapter on the host from a VM.

Any information is appreciated.

Answer 1

Hello,

By default, Hyper-V does not pass all traffic to the VM's network adapter. You need to enable promiscuous mode for the virtual machine. It is recommended that you try the following methods to see if the problem can be solved:

1. Open powershell as administrator and run this command to get the MAC address of the network adapter .

Get-VM -Name virtual machine name | Get-VMNetworkAdapter

2. Then run the following command to turn on promiscuous mode for all network adapters .

Get-VM -Name virtual machine name | Get-VMNetworkAdapter | Where-Object { $_.MacAddress -eq "MAC address" } | Set- VMNetworkAdapter -MacAddressSpoofing On

I hope this helps!

Best regards

Zunhui