Port Mirroring in vSphere Distributed Switch(VDS)

In this blog, I will shows how to configure and use the Port Mirroring functionality in the vSphere Distributed Switch.

Port mirroring is the capability on a network switch to send a copy of network packets seen on a switch port to a network-monitoring device connected to another switch port. Port mirroring is also referred to as Switch Port Analyzer (SPAN) on Cisco switches. In VMware vSphere, a Distributed Switch provides a similar port mirroring capability that is available on a physical network switch. After a port mirror session is configured with a destination—a virtual machine, a vmknic or an uplink port—the Distributed Switch copies packets to the destination.

In this blog I will use Linux01 VM to capture and monitor mirrored traffic of Linux02 VM.

In the vSphere web client , go to VM and Templates in the inventory tree and open the console of Linux01 machine which I will configure to capture the traffic from Linux02 VM
Monitor the command output for a few seconds and verify that ICMP traffic is not being captured. tcpdump output remains silent until ICMP traffic is detected on the network
Leave the console window open, with the tcpdump command running uninterrupted
In vSphere Web Client under VM and Templates, Right-click the Linux02 virtual machine and select Power > Power On.
After the Linux02 virtual machine starts, sign on as root. The Linux02 virtual machine is used as the traffic source to be monitored.
At the Linux02 command prompt, ping the default router. In my case my router in on 172.20.10.10
Go back to Linux01 VM again and click the Linux01 console tab.
In the console window, verify that the running tcpdump command is the same as before and has not captured any ICMP traffic

Now i will configure the Distributed Switch for port mirroring

In the Web Client on the left pane, click the Networking icon.
In the Networking inventory tree, select the dvs-Lab distributed switch.
In the middle pane, click the Manage tab and click the Settings tab.
Click the Port mirroring link.
In the Port mirroring panel, click the New link.

In the Add Port Mirroring Session dialog box, leave the Distributed Port Mirroring radio button selected and click Next.
Under Edit properties, select Enabled from the Status drop-down menu.
From the Normal I/O on destination ports drop-down menu, select Allowed.
Click Next
Under Select sources, click the Select distributed ports icon.
In the Select Ports dialog box, select the check box for the row with a connected entity of Linux02 and click OK.
click Next
Under Select destinations, click the Select distributed ports icon.
In the Select Ports dialog box, select the check box for the row with a connected entity of Linux01 and click OK.
Click Next
Under Ready to complete, review settings and click Finish.
In the Firefox window, click theLinux02 console tab.
Verify that the ping command is still reaching the default router at 172.20.10.10.
In the Linux01 console, examine the tcpdump output in the terminal window.
The output looks similar to the following example
You can see Now that the Linux01 (destination) has started mirroring the ICMP pings from Linux02 VM (Source).