Perform the follow steps on the Deep Discovery Inspector host to enable the capture of external mirrored traffic.

Procedure

  1. On the Hyper-V host, run the following commands in Powershell to configure the monitor mode of the Data Switch.
    $DataSwitch = "Data Switch"
    $extFeature = Get-VMSystemSwitchExtensionPortFeature `
        -FeatureName "Ethernet Switch Port Security Settings"
    $extFeature.SettingData.MonitorMode = 2
    Add-VMSwitchExtensionPortFeature `
        -ExternalPort -SwitchName $DataSwitch `
        -VMSwitchExtensionFeature $extFeature
    
  2. Run the following commands in Powershell to verify that the settings are configured correctly.
    $extFeature = Get-VMSwitchExtensionPortFeature `
        -ExternalPort -SwitchName $DataSwitch `
        -FeatureName "Ethernet Switch Port Security Settings"
    $extFeature.SettingData.MonitorMode
    If configured correctly, the resulting output is 2 to indicate that the port mirroring mode is source.
  3. Configure the monitor mode of the VM Network Adapter.
    1. In Hyper-V Manager, click on the Deep Discovery Inspector VM and then go to ActionSettings.
      The settings window appears.
    2. Expand Data Switch and then click Advanced Features.
    3. For Mirroring mode, select Destination.
      span-setting-02.png
    4. Click OK.
  4. Run the following commands in Powershell to configure the VLAN mode of the Data Switch.
    $VMName = "Deep Discovery Inspector"
    $DataSwitch = "Data Switch"
    Get-VMNetworkAdapter -VMName $VMName | 
        ? SwitchName -eq "$DataSwitch" | 
        % { Set-VMNetworkAdapterVlan -VMNetworkAdapter $_ `
        -Trunk -AllowedVlanIdList 1-4094 -NativeVlanId 0 }
  5. (Optional) Run the following commands in Powershell to configure the jumbo MTU setting on the physical adapter and prevent dropped network packets.
    Note
    Note
    For the $NetAdapter value, use the name of the physical network adapater on the Hyper-V host.
    $NetAdapter = "Ethernet0"
    Get-NetAdapterAdvancedProperty -Name $NetAdapter `
    -RegistryKeyword "*jumbopacket" | 
    Set-NetAdapterAdvancedProperty -RegistryValue 4088
  6. Start the virtual machine and verify that the traffic is mirrored and detected.