webleads-tracker

SecurActive - Virtual Traffic Capture

Virtual Traffic Capture

There are many reasons for capturing virtual traffic; frequently, some part of your application chain is not going through the physical network and remains within your virtualization chassis. To conduct a performance troubleshooting, you need to tap the virtual network. When it comes to capturing virtual traffic (i.e. traffic between several Virtual Machines hosted in one or several virtualization chassis), 3 methods are available. All three are supported by Performance Vision.

 

Promiscuous mode

This consists in setting up a port group or the virtual switch in promiscuous mode; consequently the Virtual Appliance receives all the traffic from the group (in a way which is similar to a port mirroring or SPAN). This way, Performance Vision can analyze this traffic.

 

Port mirroring on the virtual switch

Some virtual switches provide mirroring capabilities; this varies depending on the vendor and the type of switch which is implemented (e.g. Vswitch, Openvswitch, Virtual Distributed Switch Cisco Nexus, HP Connect).  They may offer SPAN and RSPAN capabilities.

 

Virtual TAP

A third option consists in installing a specialized device dedicated to traffic capture on some designated Virtual Machines and ports. The copy of the traffic can be sent to a Performance Vision Appliance (either physical or virtual) through a tunnel for analysis. Whichever method is chosen, you can use either a virtual or a physical Performance Vision appliance to analyze the traffic.  

 

For more details on this topic, please check our blog article on Virtual Traffic Capture.