THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

VM Win 11 Wireshark is not working

  • retag add tags

Proxmox 8.1.4 VM Win 11 I have a customer requirement to provide a Windows 11 VM with 2 NICS. The first NIC is a Static IP for RDP, and the 2nd NIC is to Capture Packets from a switch. My customer does not have access to the Proxmox Host, only the guests. Win 11 VM - NIC 1 is vmbr031 and is dedicated to Cisco Switch Port 41 (Static IP Mgmt for Guest OS) - NIC 2 is vmbr032 and is dedicated to Cisco Switch Port 42 (Switch Monitoring Port) Everything works fine if I plug a physical Windows 11 computer into ports 41 and 42 of the switch.

All I get from vmbr032 are STP packets.

So, how do I get vmbr032 to see/collect the packets? I posted the same question on the Proxmox forum, but no luck. Hoping the Wireshark forum can help me.

dgullett's avatar
1
dgullett
asked 2024-01-27 10:47:35 +0000
edit flag offensive 0 remove flag close merge delete

Comments

I'd look at how the vm nic is connected to the physical nic connecting to the switch span port.

Anders's avatar Anders (2024-01-28 20:36:02 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

I found the answer/statement in the post https://forum.proxmox.com/threads/pro...

My Summary:

The Linux Bridge is a switch, so it manages layer 2 (MAC) just like a switch, so only broadcast would be delivered to the VM NIC unless the traffic (frames) were intended for this NIC. So, my vmbr032 interface needed to be in "promiscuous mode." In order to do this, you have to add a line to this interface <bridge_ageing 0=""> see below in bold. Always take note at the top of /etc/network/interfaces "be careful."

auto vmbr032
iface vmbr032 inet manual
bridge-ports enp12s0
bridge-stp off
bridge-fd 0
bridge_ageing 0
dgullett's avatar
1
dgullett
answered 2024-01-29 12:38:06 +0000
grahamb's avatar
23.8k
grahamb
updated 2024-01-29 13:09:46 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer