> =A0 =A0Unfortunately you cannot do that. There is no way to put the virtu=
> network adapter into promiscuous mode so that it can see traffic addresse=
> to other NICs on the virtual switch.

> You would still need to switch the NICs to promiscuous mode, even on
> a hub. And the virtual switch is a switch, not a virtual hub.

> Hello group,
>
> I am building a security practice lab machine. The host OS is Windows
> Server 2008 R2 with Hyper-V. The guests will be Windows 2008, Windows
> 7, Vista and XP. I would like to setup one guest vm to sniff (capture
> network packets) the virtual network. How do I configure the virtual
> network to mirror all packets to a specific virtual network adapter?
>
> Thanks in advance,
>
> J Wolfgang Goerlich

> Ok. How about converting the virtual switch into a virtual hub, to
> echo out all the traffic to all attached ports? Is that possible?
>
> On Aug 13, 8:33 pm, "Bill Grant" <not.available@online> wrote:
>> Unfortunately you cannot do that. There is no way to put the virtual
>> network adapter into promiscuous mode so that it can see traffic
>> addressed
>> to other NICs on the virtual switch.
>

> None that I know of.

> Good point. Alright, any other option you can think of? Surely there
> is a way to capture network traffic between vms in Hyper-V.
>
> On Aug 14, 2:31 am, "Bill Grant" <not.available@online> wrote:
>> You would still need to switch the NICs to promiscuous mode, even on
>> a hub. And the virtual switch is a switch, not a virtual hub.

> >Anyone have any issues with this suggestion?
>
> Maybe I'm missing something, but there's no path from the sniffer to
> the other VM's, so no incoming traffic will get to the other VM's, you
> need the sniffer to be assigned to all the subnets. And RRAS has to
> know all the subnets for any routing to happen for that matter. (you
> can assign multiple IP/subnets to the same NIC...)
>
> --
> Bob Comer
>
>
> On Sat, 15 Aug 2009 14:57:46 -0500, "Paul Yhonquea" <(email address - cut out)>
> wrote:
>
>>Been trying to post to this thread all morning... here goes...
>>
>>Hello,
>>
>>
>>Here is a (wild) shot in the dark. Have the sniffer VM set up as a router
>>that all traffic has to pass through (like a default gateway). Address
>>all
>>of your VMs like the attached diagram. Have your sniffer machine setup
>>with
>>RRAS. Since it will be configured as the default gateway for all other
>>VMs,
>>all traffice will have to pass through it. Have the sniffer program
>>examine
>>all traffic coming to its 192.168.1.1 interface.
>>
>>Please examine the diagram I have attached.
>>
>>Anyone have any issues with this suggestion?
>>
>>
>>
>>Paul
>>

>Been trying to post to this thread all morning... here goes...
>
>Hello,
>
>
>Here is a (wild) shot in the dark. Have the sniffer VM set up as a router
>that all traffic has to pass through (like a default gateway). Address all
>of your VMs like the attached diagram. Have your sniffer machine setup with
>RRAS. Since it will be configured as the default gateway for all other VMs,
>all traffice will have to pass through it. Have the sniffer program examine
>all traffic coming to its 192.168.1.1 interface.
>
>Please examine the diagram I have attached.
>
>Anyone have any issues with this suggestion?
>
>
>
>Paul
>

> >So the gateway will have to see every packet that hits the
>>wire.
>
> I thought I was missing something -- the subnet mask of 255.255.0.0,
> that explains that, it would probably work as wireshark can handle
> that I think. I'm not sure I see any advantage to using the
> 192.168.x.x subnets though, a single 192.168.1.x would archive the
> same results.
>
> --
> Bob Comer
>
>
> On Sat, 15 Aug 2009 15:20:52 -0500, "Paul Yhonquea" <(email address - cut out)>
> wrote:
>
>>Hi, Robert,
>>
>>Have all of the VMs configured to where they use the same virtual network.
>>All traffic on the network depicted in the diagram has to go through
>>192.168.1.1 (sniffer/gateway IP) in order for it to get from point A (any
>>one of the VMs behind the gatway) to point B (any of the other VMs behind
>>the gateway). All of the VMs are configured on different nets
>>(192.168.2.0,
>>192.168.3.0, 192.168.4.0, and 192.168.5.0), but all have a 16 bit mask
>>(255.255.0.0). So the gateway will have to see every packet that hits the
>>wire.
>>
>>And if I remember correctly, WireShark is bound to a physical adapter, not
>>an IP address or subnet. So if the sniffer has one network adapter, all
>>traffic that goes through it will be detected by WireShark.
>>
>>
>>Am I making sense in my assumptions? Please let me know.
>>
>>
>>
>>Paul Yhonquea
>>
>>
>>
>>
>>"Robert Comer" <(email address - cut out)> wrote in message
>>news:(email address - cut out)...
>>> >Anyone have any issues with this suggestion?
>>>
>>> Maybe I'm missing something, but there's no path from the sniffer to
>>> the other VM's, so no incoming traffic will get to the other VM's, you
>>> need the sniffer to be assigned to all the subnets. And RRAS has to
>>> know all the subnets for any routing to happen for that matter. (you
>>> can assign multiple IP/subnets to the same NIC...)
>>>
>>> --
>>> Bob Comer
>>>
>>>
>>> On Sat, 15 Aug 2009 14:57:46 -0500, "Paul Yhonquea" <(email address - cut out)>
>>> wrote:
>>>
>>>>Been trying to post to this thread all morning... here goes...
>>>>
>>>>Hello,
>>>>
>>>>
>>>>Here is a (wild) shot in the dark. Have the sniffer VM set up as a
>>>>router
>>>>that all traffic has to pass through (like a default gateway). Address
>>>>all
>>>>of your VMs like the attached diagram. Have your sniffer machine setup
>>>>with
>>>>RRAS. Since it will be configured as the default gateway for all other
>>>>VMs,
>>>>all traffice will have to pass through it. Have the sniffer program
>>>>examine
>>>>all traffic coming to its 192.168.1.1 interface.
>>>>
>>>>Please examine the diagram I have attached.
>>>>
>>>>Anyone have any issues with this suggestion?
>>>>
>>>>
>>>>
>>>>Paul
>>>>
>>

>wire.
>Hi, Robert,
>
>Have all of the VMs configured to where they use the same virtual network.
>All traffic on the network depicted in the diagram has to go through
>192.168.1.1 (sniffer/gateway IP) in order for it to get from point A (any
>one of the VMs behind the gatway) to point B (any of the other VMs behind
>the gateway). All of the VMs are configured on different nets (192.168.2.0,
>192.168.3.0, 192.168.4.0, and 192.168.5.0), but all have a 16 bit mask
>(255.255.0.0). So the gateway will have to see every packet that hits the
>wire.
>
>And if I remember correctly, WireShark is bound to a physical adapter, not
>an IP address or subnet. So if the sniffer has one network adapter, all
>traffic that goes through it will be detected by WireShark.
>
>
>Am I making sense in my assumptions? Please let me know.
>
>
>
>Paul Yhonquea
>
>
>
>
>"Robert Comer" <(email address - cut out)> wrote in message
>news:(email address - cut out)...
>> >Anyone have any issues with this suggestion?
>>
>> Maybe I'm missing something, but there's no path from the sniffer to
>> the other VM's, so no incoming traffic will get to the other VM's, you
>> need the sniffer to be assigned to all the subnets. And RRAS has to
>> know all the subnets for any routing to happen for that matter. (you
>> can assign multiple IP/subnets to the same NIC...)
>>
>> --
>> Bob Comer
>>
>>
>> On Sat, 15 Aug 2009 14:57:46 -0500, "Paul Yhonquea" <(email address - cut out)>
>> wrote:
>>
>>>Been trying to post to this thread all morning... here goes...
>>>
>>>Hello,
>>>
>>>
>>>Here is a (wild) shot in the dark. Have the sniffer VM set up as a router
>>>that all traffic has to pass through (like a default gateway). Address
>>>all
>>>of your VMs like the attached diagram. Have your sniffer machine setup
>>>with
>>>RRAS. Since it will be configured as the default gateway for all other
>>>VMs,
>>>all traffice will have to pass through it. Have the sniffer program
>>>examine
>>>all traffic coming to its 192.168.1.1 interface.
>>>
>>>Please examine the diagram I have attached.
>>>
>>>Anyone have any issues with this suggestion?
>>>
>>>
>>>
>>>Paul
>>>
>

>work like a virtual hub (where all traffic is broadcast to everyone on that
>net regardless), or like a virtual switch (where the only nodes that would
>get any of the traffic are those to where the packets were destined).
>Bob,
>
>I do see your point there. I guess I used the different subnets to sort of
>guarantee that the traffic does indeed get to the sniffer's interface. I am
>not intimately familiar with how the virtual networks work, whether they
>work like a virtual hub (where all traffic is broadcast to everyone on that
>net regardless), or like a virtual switch (where the only nodes that would
>get any of the traffic are those to where the packets were destined).
>
>I was not sure if we were to, for example, have all of the machines on the
>same /24 net, would traffic from node A destined for node C be seen by node
>B. In a physical environment, only a hub would allow this (with no extra
>configuration). A switch would need to be configured to do such a thing
>(for example, Cisco's port mirroring).
>
>Your thoughts?
>
>
>Paul Yhonquea
>
>
>
>"Robert Comer" <(email address - cut out)> wrote in message
>news:(email address - cut out)...
>> >So the gateway will have to see every packet that hits the
>>>wire.
>>
>> I thought I was missing something -- the subnet mask of 255.255.0.0,
>> that explains that, it would probably work as wireshark can handle
>> that I think. I'm not sure I see any advantage to using the
>> 192.168.x.x subnets though, a single 192.168.1.x would archive the
>> same results.
>>
>> --
>> Bob Comer
>>
>>
>> On Sat, 15 Aug 2009 15:20:52 -0500, "Paul Yhonquea" <(email address - cut out)>
>> wrote:
>>
>>>Hi, Robert,
>>>
>>>Have all of the VMs configured to where they use the same virtual network.
>>>All traffic on the network depicted in the diagram has to go through
>>>192.168.1.1 (sniffer/gateway IP) in order for it to get from point A (any
>>>one of the VMs behind the gatway) to point B (any of the other VMs behind
>>>the gateway). All of the VMs are configured on different nets
>>>(192.168.2.0,
>>>192.168.3.0, 192.168.4.0, and 192.168.5.0), but all have a 16 bit mask
>>>(255.255.0.0). So the gateway will have to see every packet that hits the
>>>wire.
>>>
>>>And if I remember correctly, WireShark is bound to a physical adapter, not
>>>an IP address or subnet. So if the sniffer has one network adapter, all
>>>traffic that goes through it will be detected by WireShark.
>>>
>>>
>>>Am I making sense in my assumptions? Please let me know.
>>>
>>>
>>>
>>>Paul Yhonquea
>>>
>>>
>>>
>>>
>>>"Robert Comer" <(email address - cut out)> wrote in message
>>>news:(email address - cut out)...
>>>> >Anyone have any issues with this suggestion?
>>>>
>>>> Maybe I'm missing something, but there's no path from the sniffer to
>>>> the other VM's, so no incoming traffic will get to the other VM's, you
>>>> need the sniffer to be assigned to all the subnets. And RRAS has to
>>>> know all the subnets for any routing to happen for that matter. (you
>>>> can assign multiple IP/subnets to the same NIC...)
>>>>
>>>> --
>>>> Bob Comer
>>>>
>>>>
>>>> On Sat, 15 Aug 2009 14:57:46 -0500, "Paul Yhonquea" <(email address - cut out)>
>>>> wrote:
>>>>
>>>>>Been trying to post to this thread all morning... here goes...
>>>>>
>>>>>Hello,
>>>>>
>>>>>
>>>>>Here is a (wild) shot in the dark. Have the sniffer VM set up as a
>>>>>router
>>>>>that all traffic has to pass through (like a default gateway). Address
>>>>>all
>>>>>of your VMs like the attached diagram. Have your sniffer machine setup
>>>>>with
>>>>>RRAS. Since it will be configured as the default gateway for all other
>>>>>VMs,
>>>>>all traffice will have to pass through it. Have the sniffer program
>>>>>examine
>>>>>all traffic coming to its 192.168.1.1 interface.
>>>>>
>>>>>Please examine the diagram I have attached.
>>>>>
>>>>>Anyone have any issues with this suggestion?
>>>>>
>>>>>
>>>>>
>>>>>Paul
>>>>>
>>>
>

>for that node.

>>They act as a virtual switch, so each node only sees packets destined
>>for that node.
>
>That was my original belief. So, in theory, do you think my idea about
>using the sniffer as a default gateway will work? That is the only way I
>can think to get all traffic to the sniffer.
>
>I am open to critiques.
>
>
>Paul Yhonquea
>

> "Bill Grant" <not.available@online> wrote:
>> None that I know of.
>
> Alright. Please let me know if you think of anything.
>
> I will keep at it. I have installed a Win2003 32-bit guest with a
> standard network adapter (Microsoft virtual machine bus network
> adapter). Installed Wireshark 1.2.1 with WinPcap. Configured WinPcap
> to run as a service. Plugged the network adapter into a external
> virtual network. The guest is able to sniff all broadcast traffic and
> all traffic directed to it.
>
> J Wolfgang Goerlich

>>They act as a virtual switch, so each node only sees packets destined
>>for that node.
>
> That was my original belief. So, in theory, do you think my idea about
> using the sniffer as a default gateway will work? That is the only way I
> can think to get all traffic to the sniffer.
>
> I am open to critiques.
>
>
> Paul Yhonquea
>
>

>
>
> "Paul Yhonquea" <(email address - cut out)> wrote in message
> news:e4c$(email address - cut out)...
>>>They act as a virtual switch, so each node only sees packets destined
>>>for that node.
>>
>> That was my original belief. So, in theory, do you think my idea about
>> using the sniffer as a default gateway will work? That is the only way I
>> can think to get all traffic to the sniffer.
>>
>> I am open to critiques.
>>
>>
>> Paul Yhonquea
>>
>>
>
> Packets only go to the default gateway if they need to leave the segment.
> If all machines are in the same segment and the same IP subnet they
> communicate directly "on the wire" using MAC addresses. Each machine would
> need to be in a different IP subnet to force the traffic to use the DG.
>
> So yes, forcing all traffic to use one NIC (which was running a sniffer)
> would be worth a try. But it rather defeats the purpose, since you have
> dramatically changed the network you are trying to monitor.
>
>