zoukankan      html  css  js  c++  java
  • 虚机抓取Hyper-V宿主的镜像流量(Windows Server 2012R2)

    1.将交换机流量镜像到Hyper-V宿主的一块网卡(eth4)

    2.在Hyper-V宿主上新建虚拟交换机(Network_Mirror),选择外部网络,扩展属性中启用“Microsoft NDIS捕获”,设置如下图所示:

     

    3.在已创建好的虚机上,选择使用“Network_Mirror”虚拟交换机,然后在高级功能中,镜像模式选择“目标”,即该虚机用来接收镜像流量

    4.选择流量来源,在Hyper-V宿主上运行PowerShell命令:

    $VMSwitchPortFeature = Get-VMSystemSwitchExtensionPortFeature -FeatureName 'Ethernet Switch Port Security Settings' #选择扩展功能 - 交换机端口安全设置“类”
    $VMSwitchPortFeature.SettingData.MonitorMode = 2 #MonitorMode参数说明(0 = 无, 1 = 目标, 2 = 来源)
    Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName 'Network_Mirror' -VMSwitchExtensionFeature $VMSwitchPortFeature #将该功能加入到该虚拟交换机

    注:All traffic hitting the hyper-v Host is also hitting the external port of the virtual switch. However for the NIC on the VM to get these packets, we need to now “mirror” this Switch port (on the Virtual switch) to let him know that he has to forward the packets onto the “DESTINATION” we had configured earlier.

    5.在虚机(CentOS)上运行命令监控镜像流量:

    tcpdump -i eth1 -w /tmp/a.txt

    运行tail -f tmp/a.txt 可以看到捕获到的镜像流量

    附:

    参考:

    https://blogs.technet.microsoft.com/networking/2015/10/16/setting-up-port-mirroring-to-capture-mirrored-traffic-on-a-hyper-v-virtual-machine/

    https://dotblogs.com.tw/terrychuang/2015/01/19/148176

  • 相关阅读:
    MySql-数据库基础
    Window安装MySQL
    Python程序中的进程操作-进程间通信(multiprocess.Queue)
    线程
    上传电影代码
    并发编程基础
    基于socketserver实现并发的socket编程
    模拟ssh远程执行命令
    GIT的使用,Pycharm中使用GitHub
    主机如何访问运行在虚拟机中的Django项目
  • 原文地址:https://www.cnblogs.com/dreamer-fish/p/9512323.html
Copyright © 2011-2022 走看看