VMware Distributed vSwitch Monitoring

Overview

Flowmon for VMware has the ability to monitor traffic and generate NetFlow/IPFIX flow data. Follow the steps below to enable this functionality for the monitoring of a VMware Distributed vSwitch (DSwitch).

Network traffic from a virtual machine is monitored by a Flowmon instance running on the same host. This concept requires a Flowmon instance to be deployed on each physical host where monitored virtual machines could potentially run.

Prerequisites

You must have a running instance of Flowmon for VMware - a Flowmon Collector (with a built-in Probe) or a Flowmon Probe.

Deployment

To monitor a DSwitch, distributed port mirroring must be configured. Flowmon for VMware must be deployed on each VMware host (ESXi server) and connected to the DSwitch you want to monitor:

1. Port IDs of all Flowmon monitoring ports must be collected. Port IDs can be found in Edit Settings > Network adapter settings. For an appliance with one monitoring port, check the port ID of Network adapter 2. For appliances with more monitoring ports, check the port IDs of for Network adapters from 3 to x (x equals 4, 6, 8 depending on the number of monitoring ports – 2, 4, or 6). Port IDs will be used as destinations in the monitoring session.

2. Using the same procedure, collect the Port IDs of the virtual machines that should be monitored. These Port IDs will be used as sources in the monitoring session.

3. In DSwitch configuration, select the Manage tab and click Port mirroring.

4. Create a new monitoring session by clicking the New button. In the first step, choose the Distributed Port Mirroring option and click Next.

5. Enter a name for the session and click Next.

6. Select the Port IDs of virtual machines that should be monitored and click Next.

7. In the Select destinations window, select the Port IDs of Flowmon's monitoring interfaces and click Next.

8. Check the settings before clicking Finish.

When you add a new virtual machine that you would like to monitor, you must update the list of source ports.

Flowmon Configuration

To ensure continuous traffic visibility, disable migration for all Flowmon instances.

No configuration specific for VMware Distributed vSwitch Monitoring is required. Refer to the Flowmon User Guide for instructions on how to enable a monitoring port.