Share via

Azure Ubuntu VM's vNIC in promiscuous mode?

RameshShanmugasundaram-4807 21 Reputation points
2022-01-27T20:34:16.493+00:00

Hi,

Can I turn on promiscuous mode on a Azure Ubuntu VM's vNIC and see packets that belong to the subnet (vNET the vNIC belongs to)?

I could enable promiscuous mode from the Ubuntu Linux shell. However, when I run tcpdump, I do not see traffic from other VMs in the vNET.

Is this feature not supported in Azure VM?

Thanks.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,347 questions
0 comments
Accepted answer
  1. srbhatta-MSFT 8,546 Reputation points Microsoft Employee
    2022-02-14T04:44:43.24+00:00

    Hello @RameshShanmugasundaram-4807 ,

    Thank you for your patience. Apologies for the delay in response as I was waiting to get an update from the concerned team. I checked internally and to our knowledge, VM's vNIC in promiscuous mode is not supported or will not work as expected. A vNIC in Azure will infact only see the traffic (unicast) directed at the VM itself or the VM as the next hop forwarding target. Other traffic on the same “subnet” will only flow between the source/destination VMs, not other VMs in the same subnet. There is vTAP feature in the work that may be relevant to your question but that us on the roadmap, and I will be able to provide you more details on that once I get an update from the specific team internally.

    -----------------------------------

    Please don't forget to Accept as Answer and Upvote and if you think my response was helpful.

    1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gene Laisne 1 Reputation point
    2022-01-28T21:27:53.893+00:00

    I think you would be better off using Azure's packet capture. This should provide what you are looking for.

    https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-manage-portal#start-a-packet-capture

  2. Gene Laisne 1 Reputation point
    2022-02-04T15:29:52.043+00:00

    Sorry, I've been looking for official documentation for promiscuous mode documentation without any luck. My thought is to go back and try again, but maybe force traffic and see what you get.

    I speculate that the Azure backplane does not allow or would not let you access packets on the network. One option might be a nested VM (Create a Host server in Azure and on a guest system on that new host, you turn on promiscuous mode), if that may suite your needs. If not, I suspect Azure may not be your best option.