Configuring Capture Ports in Virtual Appliances

The Default ESXi Virtual Switch Configuration

By default, ESXi has a single virtual switch configured (in our example here it is labelled vSwitch0). The default virtual switch has a single physical NIC (again labelled ‘vmnic0’ in out example). Similarlt there are 2 default port groups, one for the management interface and another for the install Byte25 Virtual Appliance.

The default virtual switch topology is shown in the diagram on the right.

Adding a New Virtual Switch

To support promiscuous ports visible to the DPI engine in the virtual appliance, a new virtual switch needs to be configured in ESXi. This new virtual switch will have the  physical NIC used for capture and an associated port group’ to make it available to the appliance.

To add a new virtual switch, from the ESXi console, go to the Networking->Virtual Switches page and select ‘Add standard virtual switch’. From the popup window give the vSwitch a name (in out case we user ‘Capture vSwitch 1’, and select the physical NIC to add from the ‘Uplink’ drop down menu. In our example we are adding ‘vmnic1’.

Set Ports in vSwitch to Promiscuous Mode

The newly added vSwitch shold appear in the left hand panel of the ESXi console. When selected, it should show the newly added physical port. In order to capture network traffic, the port needs to be placed in ‘promiscuous’ mode.

Select the new virtual switch and from the Edit Settings popup window, select Security and set the Promiscuous checkbox to ‘Accept’. 

Configure Port Groups on the new vSwitch

By default, the new vSwitch just added will have no port groups defined. We need to define a port group to make the capture port defined in the virtual switch visible to the Byte25 virtual appliance.

Navigate to the ‘Networking->Port Groups’ page on the ESXi console and select the ‘Add Port Group‘ option.

Give th new port grpups a name (in our case Capture 1 Port Group) and assign it to the newly created virtual switch (again, in our example, Capture vSwitch 1).

 Add Network Interface/Port Group to Virtual Appliance

The last step is to add a new network interface to the Byte25 virtual appliance, this will make the capture NIC visible under Byte25 .

Open the virtual appliance settings by clicking on the virtualappliance name in the ESXi console and select the Edit Settings button.  This will open a configuration window for the virtual appliance, select ‘Add New Network Adaptor’ and a new entry will appear. Make sure that the correct port group is defined for the new interface – in our example, this is called ‘Capture 1 Port Group’

Confirm the Configuration

To check the ESXi confuration, click on the newly created virtaul switch. You should see a configuration similar to the one shown on the right. That is, the Byte25 Virtual Appliance connected to the Capture Port Gropup which is in turn cionnected to a physical NIC.

Open a console session to the Byte25 Virtual Appliance and log in as ‘admin’.  Run the showinterfaces command and you should see the newly added ‘capture’ port. In our example, the port is named  ‘ens36’.

To ensure that this port is configured for DPI data collection run the setcapture command:

setcapture ens36 enable

Data from the newly configured capture port should start exporting to the cloud dashboard after 5 minutes.