Is it possible to mirror port to capture packets between VM host and VM?

Question

I have 2 physical machines, A and B. A runs VMWare Workstation with a virtual machine C. C is using Bridged network interface.

A and B are both connected via ethernet to a switch. B has two NIC's. If I used port mirroring on A's connection to the switch, and then put that into B, would I be able to capture traffic between A and C? Does that traffic go to the switch, or does it get short circuited somehow?

Thanks in advance!

Solution

VMware Workstation network traffic does indeed short-circuit inside of the host machine. Traffic from VMs on that machine to the host itself will never hit that Ethernet switch. It's a kind of virtual switch inside the Host, so traffic that can be handled locally will be handled locally; no need to forward it to the switch in the closet.

In order to capture that traffic, the capture has to be performed on the host itself. I do this frequently when checking on things like startup-traffic for a VM.

Comments

[Dwayne]

@sysadmin1138. What about VM to VM traffic on the same host? I simplified the example a little bit. Actually A has 2 VM's, C and D. I want to know if I can capture packets from C to D with B. The VM set up is a test environment. In deployment, C and D are actually physical machines and there is no A.

[Deb]

I'm not sure about workstation, actually. I suspect that functionality is not present because of how the software bridge works, but it could be wrong.

[Dwayne]

I think I'm kinda getting on the right track and can do research myself. Thanks. link, link