Virtual Packet Decoder - Physical Network Tap

[Anonymous]

Hi everyone,

I'm looking to deploy a Virtual Packet Decoder but using a Physical network tap. There are documents surrounding the use of vSwitch promiscuous mode and Virtual taps, but nothing around physical taps.

I do realise that if I use a physical tap that virtual machine will be 'locked' to the physical host and a particular physical interface on that esx host.

Has anyone done this before?

Thanks.

[KEVINDIENST]

We have a virtualized packet decoder. Our taps feed into aggregation systems by Gigamon. The Gigamon then provides these "raw" feeds as a "datafeed" that we drop to the network card on the decoder. In this instance a virtual NIC associated to the VM. If you want I can reach out to my VM team and see what is configured on the vSwitch side.

[Anonymous · Accepted solution]

Hi Kevin,

Sorry to revive a very old thread. I was wondering if you could ask your VM guys what they've configured for the network tap?

I went to move our taps over to the virtual today and was getting nothing.

I configured a separate vSwitch for the physical interfaces and assigned a network card to the VM decoder that was on that switch.

Configured the decoder to capture on that interface in the NetWitness config.

I know I'm just missing something really tiny.

Thanks for your help.

[Anonymous]

I figured out what my issue was. I wasn't seeing any packet traffic on the virtual decoder.

I have to configure VLAN 4095 on the PortGroup in order to see everything the tap was sending to the virtual switch.

[KEVINDIENST]

Good to know! Sorry I didn't get back to you sooner, apologies for that.