Packet capture from mirrored switch port to VM guest

[Adam Moffett]

I need to capture traffic from an LTE base station to assist the vendor in troubleshooting. I happened to have a Proxmox VE installation at the site already, so I wanted to try using that to capture traffic.

I have wireshark installed on a Windows guest. I had an extra NIC (eth3) on the host so I created a new bridge with eth3 as a member and then added a new e1000 interface to the guest. I confgured the switch to mirror traffic from the LTE unit to the port which host eth3 is connected to.

The bridge discards this traffic since the destination MAC addresses are not present on the bridge. This behavior makes perfect sense in hindsight, but I was wondering if there's any way around it. I found several (old) examples on the web which said to set the bridge ageing timeout to 0, but that doesn't seem to work for me. Any suggestions?

I can capture traffic on the Proxmox host, but the vendor's support person is more comfortable working in WIndows.

 

[wolfgang]

Hi,

try to use instead e1000 the virtio bus.

Or make a tcpdump file on the Host and send it to the support then he can analyse it with wireshark on windows.

 

[Adam Moffett]

Hi,
Or make a tcpdump file on the Host and send it to the support then he can analyse it with wireshark on windows.

For the short term that's exactly what I did. I'll try using the VirtIO driver.

 

[Aron Dijkstra]

Open a remote SSH tunnel from the monitoring box to the server to be monitored. Run TCPdump and let it stream to this machine. something like: tcpdump port 5060 -s 0 -w - if you want to see SIP packets.

You also can use this sollution to capture packets on a remote linux server and route it over a layer 3 network.