Hyper-V Virtual Switch Port Monitoring

Overview

Flowmon for Hyper-V has the ability to monitor traffic and generate NetFlow/IPFIX flow data. Follow the steps below to enable this functionality for the monitoring of a Virtual Switch local to the Hyper-V host where Flowmon is running.

Prerequisites

You must have a running instance of Flowmon for Hyper-V - a Flowmon Collector (with a built-in Probe) or a Flowmon Probe.

Deployment

To create a new Hyper-V Virtual Switch, you must:

1. Open Hyper-V Manager and click Virtual Switch Manager....

2. Click Create Virtual Switch and select the switch type. An External switch is bound to a physical interface, Internal or Private is not.

3. Specify a name for the virtual switch and, if it is an external switch, select the appropriate External network and click OK.

To monitor an existing Hyper-V Virtual Switch, you must:

1. Connect to the Hyper-V host.

2. Open PowerShell and set up traffic mirroring to the virtual switch of your choice. Replace NameOfCreatedSwitch below with the name of your virtual switch. This configuration will mirror all external traffic to any virtual interface marked with Mirroring mode - Destination connected to the same virtual switch.

$portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureName "Ethernet Switch Port Security Settings"
$portFeature.SettingData.MonitorMode = 2

Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName "NameOfCreatedSwitch" -VMSwitchExtensionFeature $portFeature

For internal or shared management switches, use the following:

$portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureName "Ethernet Switch Port Security Settings"
$portFeature.SettingData.MonitorMode = 2

Add-VMSwitchExtensionPortFeature -ManagementOS -VMSwitchExtensionFeature $portFeature

Ensure your Flowmon instance is connected to this virtual switch and its monitoring interface is configured as a Destination for mirroring.

Optionally, if you intend to monitor VLAN traffic:

1. Connect to the Hyper-V host.

2. Open PowerShell and rename all network adapters associated with your Flowmon instance. Adjust the number of interfaces, if needed. Replace NameOfCreatedVirtualMachine with the name of your Flowmon instance in Hyper-V.

$VMNetAdap = Get-VMNetworkAdapter -VMName "NameOfCreatedVirtualMachine"
rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[0] -newname "Management 1"
rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[1] -newname "Management 2"
rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[2] -newname "Monitoring 1"
rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[3] -newname "Monitoring 2"

3. For each monitoring interface that is intended for VLAN traffic monitoring, configure a trunk. Replace NameOfCreatedVirtualMachine below with the name of your Flowmon instance in Hyper-V.

Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "1-4094" -VMName "NameOfCreatedVirtualMachine" -VMNetworkAdapterName "Monitoring 1" -NativeVlanId 0
Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "1-4094" -VMName "NameOfCreatedVirtualMachine" -VMNetworkAdapterName "Monitoring 2" -NativeVlanId 0

Flowmon Configuration

No configuration specific for Hyper-V Virtual Switch monitoring is needed. Refer to the Flowmon User Guide for instructions on how to enable a monitoring port.