Mirroring ports is a method of monitoring network traffic. Basically, the switch sends a copy of the packets to another port. If we connect a listening software, better known as a “sniffer” (tcpdump, wireshark etc.), we can log all packets sent to this port and analyze them. This is quite usefull in testing scenarios.
VMware ESXi added port mirroring since version 5 but you need a distributed switch configured. If you have only 1 ESXi host, this feature is nonexistent .
It is quite simple to get the same functionality without a distributed switch on a single host:
- Create a new port group in the desired vSwitch.
- Put the port group in promiscous mode.
- Set the VM which you need to capture its traffic (let’s call it Test VM) into the new port group.
- Create a new VM which will act the sniffer (and call it sniffer) and add it to the above mirrored port group.
All traffic to and from Test VM will be captured by sniffer as well. Here is how it looks: