Configuring promiscuous mode on a virtual switch or portgroup
book
Article ID: 324520
calendar_today
Updated On:
Products
VMware vCenter ServerVMware vSphere ESXi
Issue/Introduction
By default, a guest operating system's virtual network adapter only receives frames that are meant for it. Placing the guest adapter in promiscuous mode causes it to detect all frames passed on the virtual switch on that host only that are allowed under the VLAN policy for the associated port group. This can be useful for intrusion detection monitoring or if a sniffer needs to be run to analyze all traffic on the wire.
Promiscuous mode is disabled by default, and should not be turned on unless specifically required. Software running inside a virtual machine may be able to monitor any and all traffic moving across a vSwitch if it is allowed to enter promiscuous mode.
You likely need to set the VLAN 4095 at the port group level, which allows the port group to see the traffic on any VLAN while leaving the VLAN tags intact.
Note: From esxcli you can enable promiscuos mode. But this command is only available for Standard Switches and not for Distributed Switches:
# esxcli network vswitch standard policy security set -p true --vswitch-name vSwitchName The vSwitchName can be retrieved from "esxcli network vswitch standard list"