ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual Server 2005

Recent Virtual Server 2005 posts

* hyper-v licencing
* transfer a windows server to Hyper-v
* MOSS 2007 VHD Networking
* Hyper-V on Win2008 R2 Datacenter SP2 Evaluation
* The VSS writer failed to get the properties of the virtual machine
* Networking Problem. How to fix, if the VM Network Services is miss
* server 2008 hyper v install
* SCVMM/Hyper-V P2V conversion errors out
* VHDMOUNT error - Failed to plug the Virtual Hard Disk (VHD)
* Hyper-v Cluster
* Network/installer issues with VS2005R2sp1
* Backin up guest VM off Hyper-V Server
* Hyper-V Host - Domain or Workgroup?
* Hyper-V High Physical Disk queue on guest system
* Error (13231): - scvmm p2v
* Windows2008ServerVM\SQLServer2008\HangsUp
* lost vhd files - Hyper-V
* Remote Access Hyper-V?
* Savely remove USB drive?
* Hardware Monitoring with Hyper-V?

Add Solution

VS 2005 R2: Promiscuous mode ethernet on for VM running Wireshark?

Source: microsoft.public.virtualserver
Sent: 07/29/2009
From: chucko
Message:

All,

QUESTION: Is it possible for a VM to promiscuously listen to *all* packets
coming in on a physical NIC on the VS 2005 R2 host, where the VM has a
dedicated connection to that NIC?

Searches for "promiscuous" and "wireshark" returned no results...
Searching other forums, it appears that modifying the
"allow_promiscuous_mode" parameter in a VM's .vmc file will *only* set a
Virtual Network switch (which has multiple VM's attached) to promiscuous
mode, allowing VM's to see each other's traffic on the shared virtual switch.

But in the case where a VM has a dedicated "bridged" connection to a
physical NIC on the MSVS host, we have the need (for a networking class) to
run Wireshark on the VM to monitor *all* packets that are presented to the
physical NIC on the MSVS host - the NIC is connected to an external switch
that has been set up to "mirror" all packets from another port. The port
counters indicate that all the packets *are* being sent out the attached port
on teh switch - but Wireshark on the VM (Windows XP Pro) only sees packets
that are either multicast/broadcast, or are unicast to the VM's Unicast MAC
address.

It appears this is not possible, or is a limitation of VS 2005 R2 -
but I'm hoping for a definitive answer.... Fwiw, this *does* work on ESX 3.5..

Many thanks, best regards,

-Chuck O.

Post Reply | This is Spam! | Mark as Spam

Related Messages

Re: VS 2005 R2: Promiscuous mode ethernet on for VM running Wireshark?

Sent: 07/29/2009
From: "Steve Jain [MVP]" <(email address - cut out)>
Message:

On Wed, 29 Jul 2009 06:23:01 -0700, chucko
<(email address - cut out)> wrote:

Nope, a VM won't see the host's network traffic. Data is routed
before it gets to the VM's virtual NIC.
For details, see Ben's blog:
http://blogs.msdn.com/virtual_pc_guy/archive/2006/09/27/774228.aspx

--
Cheers,
Steve Jain, Virtual Machine MVP
http://vpc.essjae.com/

Show quoted text

> All,
>
>QUESTION: Is it possible for a VM to promiscuously listen to *all* packets
>coming in on a physical NIC on the VS 2005 R2 host, where the VM has a
>dedicated connection to that NIC?
>
> Searches for "promiscuous" and "wireshark" returned no results...
>Searching other forums, it appears that modifying the
>"allow_promiscuous_mode" parameter in a VM's .vmc file will *only* set a
>Virtual Network switch (which has multiple VM's attached) to promiscuous
>mode, allowing VM's to see each other's traffic on the shared virtual switch.
>
> But in the case where a VM has a dedicated "bridged" connection to a
>physical NIC on the MSVS host, we have the need (for a networking class) to
>run Wireshark on the VM to monitor *all* packets that are presented to the
>physical NIC on the MSVS host - the NIC is connected to an external switch
>that has been set up to "mirror" all packets from another port. The port
>counters indicate that all the packets *are* being sent out the attached port
>on teh switch - but Wireshark on the VM (Windows XP Pro) only sees packets
>that are either multicast/broadcast, or are unicast to the VM's Unicast MAC
>address.
>
> It appears this is not possible, or is a limitation of VS 2005 R2 -
>but I'm hoping for a definitive answer.... Fwiw, this *does* work on ESX 3.5..
>
> Many thanks, best regards,
>
>-Chuck O.

Re: VS 2005 R2: Promiscuous mode ethernet on for VM running Wiresh

Sent: 07/29/2009
From: chucko
Message:

Steve,

Thank you very much for your response, and for the URL, which seems
definitive (and is - unfortunately - exactly in line with what I'm seeing).

Thanks again, Best regards,

-Chuck O.

"Steve Jain [MVP]" wrote:

Show quoted text

> On Wed, 29 Jul 2009 06:23:01 -0700, chucko
> <(email address - cut out)> wrote:
>
> > All,
> >
> >QUESTION: Is it possible for a VM to promiscuously listen to *all* packets
> >coming in on a physical NIC on the VS 2005 R2 host, where the VM has a
> >dedicated connection to that NIC?
> >
> > Searches for "promiscuous" and "wireshark" returned no results...
> >Searching other forums, it appears that modifying the
> >"allow_promiscuous_mode" parameter in a VM's .vmc file will *only* set a
> >Virtual Network switch (which has multiple VM's attached) to promiscuous
> >mode, allowing VM's to see each other's traffic on the shared virtual switch.
> >
> > But in the case where a VM has a dedicated "bridged" connection to a
> >physical NIC on the MSVS host, we have the need (for a networking class) to
> >run Wireshark on the VM to monitor *all* packets that are presented to the
> >physical NIC on the MSVS host - the NIC is connected to an external switch
> >that has been set up to "mirror" all packets from another port. The port
> >counters indicate that all the packets *are* being sent out the attached port
> >on teh switch - but Wireshark on the VM (Windows XP Pro) only sees packets
> >that are either multicast/broadcast, or are unicast to the VM's Unicast MAC
> >address.
> >
> > It appears this is not possible, or is a limitation of VS 2005 R2 -
> >but I'm hoping for a definitive answer.... Fwiw, this *does* work on ESX 3.5..
> >
> > Many thanks, best regards,
> >
> >-Chuck O.
>
> Nope, a VM won't see the host's network traffic. Data is routed
> before it gets to the VM's virtual NIC.
> For details, see Ben's blog:
> http://blogs.msdn.com/virtual_pc_guy/archive/2006/09/27/774228.aspx
>
> --
> Cheers,
> Steve Jain, Virtual Machine MVP
> http://vpc.essjae.com/
>

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: