Hyper-V Network Interface Mirroring

Overview

Use Flowmon for Hyper-V to monitor network traffic and generate Network Flow (NetFlow) or Internet Protocol Flow Information Export (IPFIX) data. This guide shows how to monitor network interfaces on virtual machines running on your Hyper-V host.

Prerequisites

You must have a running instance of Flowmon for Hyper-V - a Flowmon Collector (with a built-in Probe) or a Flowmon Probe.

Deployment

Right-click each virtual machine you want to monitor and select Settings. For each selected network adapter click Advanced Features and select Source as the Mirroring mode. Keep in mind that your Flowmon's monitoring port must be attached to the same virtual switch as these network adapters.

Ensure your Flowmon instance has the Mirroring mode set to Destination and that it resides on the same virtual switch.

Optionally, if you intend to monitor VLAN traffic:

1. Connect to the Hyper-V host that is hosting your Flowmon instance.

2. Open PowerShell and rename all network adapters associated with your Flowmon instance. Adjust the number of interfaces, if needed. Replace NameOfCreatedVirtualMachine below with the name of your Flowmon instance in Hyper-V:

   $VMNetAdap = Get-VMNetworkAdapter -VMName "NameOfCreatedVirtualMachine"
   rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[0] -newname "Management 1"
   rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[1] -newname "Management 2"
   rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[2] -newname "Monitoring 1"
   rename-VMNetworkAdapter -VMNetworkAdapter $VMNetAdap[3] -newname "Monitoring 2"
   

3. For each monitoring interface that is intended for VLAN traffic monitoring, configure a trunk. Replace NameOfCreatedVirtualMachine below with the name of your Flowmon instance in Hyper-V:

   Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "1-4094" -VMName "NameOfCreatedVirtualMachine" -VMNetworkAdapterName "Monitoring 1" -NativeVlanId 0
   Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "1-4094" -VMName "NameOfCreatedVirtualMachine" -VMNetworkAdapterName "Monitoring 2" -NativeVlanId 0
   

Flowmon Configuration

No configuration specific for Hyper-V network interface mirroring is needed. Refer to the Flowmon User Guide for instructions on how to enable a monitoring port.