2V0-621 · Question #148
An administrator tries to capture network traffic for a virtual machine, but cannot see the expected traffic in the packet capture tool. Which step can resolve the problem?
The correct answer is B. Enable Promiscous Mode on the relevant port group. Promiscuous mode must be enabled on the port group so the packet capture VM can receive all frames traversing the virtual switch segment, not just those addressed to its own MAC.
Question
An administrator tries to capture network traffic for a virtual machine, but cannot see the expected traffic in the packet capture tool. Which step can resolve the problem?
Options
- AMigrate the virtual machine to a Distributed Virtual Switch.
- BEnable Promiscous Mode on the relevant port group.
- CModify the default value of MAC Address changes.
- DEnable Forged Transmits on the virtual machine.
How the community answered
(45 responses)- A2% (1)
- B78% (35)
- C13% (6)
- D7% (3)
Why each option
Promiscuous mode must be enabled on the port group so the packet capture VM can receive all frames traversing the virtual switch segment, not just those addressed to its own MAC.
Migrating to a Distributed Virtual Switch changes the switch type but does not by itself enable promiscuous access; the security policy must still be changed to allow the capture VM to see all traffic.
By default, a virtual switch drops frames not destined for the vNIC's MAC address; enabling Promiscuous Mode on the port group overrides this behavior and allows the network adapter to pass all traffic to the guest OS, which is required for a packet capture tool to observe traffic from other virtual machines on the same segment.
MAC Address Changes controls whether the guest can alter its own MAC address; it does not affect whether the vNIC receives frames destined for other MAC addresses.
Forged Transmits controls whether frames sent with a MAC different from the vNIC's configured address are allowed to leave the port; it does not enable reception of traffic addressed to other machines.
Concept tested: vSwitch promiscuous mode for packet capture
Source: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-92F3AB1F-B4C5-4F25-A010-8820D7250350.html
Topics
Community Discussion
No community discussion yet for this question.