2nd NIC for network monitor

[graylion]

Hi all

I would like to run a network monitor as a VM. The VM would have 2 NICs, one regular and one running in promiscuous mode for analysing netword traffic from a SPAN port on a switch. The way I am thinking of building this is:

SPAN port --> 2nd NIC on Host --> dedicated bridge -> 2nd NIC on VM.

Could this work?

Thanks!

 

[jgreco]

Well, no, because a bridge is not a span port. It won't handle unicast packets in the way you would need.

This is why you would normally use a virtual function if you were virtualizing a network monitor of some sort on a hypervisor like ESXi. It gives you access to the actual ethernet hardware.

 

[graylion]

well, I was thinking this. https://serverfault.com/questions/798001/kvm-bridge-for-promisc-interface-ids

 

[jgreco]

So then you've made me explain to you some of the same things explained in the first answer there, but didn't bother mentioning that you were also considering using some weird hacky solution in addition to a bridge, to fix the obvious problem with using just a bridge.

In any case, I already gave you the technologically better and non-hacky answer to your question.

 

[graylion]

Does TrueNAS provide this function? I am aware of ESXi.

 

[jgreco]

Does TrueNAS provide this function?

Am I to do your homework for you? I have no idea. It theoretically could, but TrueNAS SCALE is relatively immature, so who knows if it actually works.

I am aware of ESXi.

Then perhaps you should use it, as modern TrueNAS generally virtualizes just fine on modern ESXi, and you can definitely get a variety of passthru ethernet options as long as all the components support it.

 

[graylion]

Am I to do your homework for you? I have no idea. It theoretically could, but TrueNAS SCALE is relatively immature, so who knows if it actually works.



Then perhaps you should use it, as modern TrueNAS generally virtualizes just fine on modern ESXi, and you can definitely get a variety of passthru ethernet options as long as all the components support it.

I am asking the community. As one does.