Perform the follow steps on the Deep Discovery Inspector host to enable the capture of external mirrored traffic.
Procedure
- On the Hyper-V host, run the following commands in Powershell to configure the
monitor mode of the Data Switch.
$DataSwitch = "Data Switch" $extFeature = Get-VMSystemSwitchExtensionPortFeature ` -FeatureName "Ethernet Switch Port Security Settings" $extFeature.SettingData.MonitorMode = 2 Add-VMSwitchExtensionPortFeature ` -ExternalPort -SwitchName $DataSwitch ` -VMSwitchExtensionFeature $extFeature
- Run the following commands in Powershell to verify that the settings are
configured correctly.
$extFeature = Get-VMSwitchExtensionPortFeature ` -ExternalPort -SwitchName $DataSwitch ` -FeatureName "Ethernet Switch Port Security Settings" $extFeature.SettingData.MonitorMode
If configured correctly, the resulting output is 2 to indicate that the port mirroring mode is source. - Configure the monitor mode of the VM Network Adapter.
- In Hyper-V Manager, click on the Deep Discovery Inspector VM and
then go to . The settings window appears.
- Expand Data Switch and then click Advanced Features.
- For Mirroring mode, select
Destination.
- Click OK.
- In Hyper-V Manager, click on the Deep Discovery Inspector VM and
then go to .
- Run the following commands in Powershell to configure the VLAN mode of the Data
Switch.
$VMName = "Deep Discovery Inspector" $DataSwitch = "Data Switch" Get-VMNetworkAdapter -VMName $VMName | ? SwitchName -eq "$DataSwitch" | % { Set-VMNetworkAdapterVlan -VMNetworkAdapter $_ ` -Trunk -AllowedVlanIdList 1-4094 -NativeVlanId 0 }
- (Optional) Run the following commands in Powershell to configure the jumbo MTU
setting on the physical adapter and prevent dropped network packets.
Note
For the$NetAdapter
value, use the name of the physical network adapater on the Hyper-V host.$NetAdapter = "Ethernet0" Get-NetAdapterAdvancedProperty -Name $NetAdapter ` -RegistryKeyword "*jumbopacket" | Set-NetAdapterAdvancedProperty -RegistryValue 4088
- Start the virtual machine and verify that the traffic is mirrored and detected.