# Monitoring of intra virtual machines network traffic on same physical host

**URL:** <https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870>\
**Category:** Zeek\
**Created:** [October 19, 2015, 5:31am UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870 "2015-10-19T05:31:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradyumna\_Joshi](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@Pradyumna\_Joshi](https://community.zeek.org/u/Pradyumna_Joshi)\
**Post date:** [October 19, 2015, 5:31am UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870/1 "2015-10-19T05:31:44Z")

</div>

Is it possible to monitor network traffic between different Virtual machines on the same physical machine using Bro?

Thanks.

Joshi Pradyumna

Computer Center,  
Homi Bhabha National Institute,

Mumbai.

---

<div class="post-metadata">

**Author:** ![Shane\_Castle](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@Shane\_Castle](https://community.zeek.org/u/Shane_Castle)\
**Post date:** [October 19, 2015, 10:27am UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870/2 "2015-10-19T10:27:41Z")

</div>

This is really a specific version of the more general question, is it possible  
to sniff traffic between VMs on the same physical host? The answer is, it  
depends: what virtualization tool is being used? If it's VMware vSphere, then  
yes:  
[https://blogs.vmware.com/vsphere/2011/08/vsphere-5-new-networking-features-port-mirroring.html](https://blogs.vmware.com/vsphere/2011/08/vsphere-5-new-networking-features-port-mirroring.html)

I don't know of this capability existing on any other virtualization platform.

---

<div class="post-metadata">

**Author:** ![Pradyumna\_Joshi](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@Pradyumna\_Joshi](https://community.zeek.org/u/Pradyumna_Joshi)\
**Post date:** [October 19, 2015, 4:43pm UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870/3 "2015-10-19T16:43:26Z")

</div>

Thanks Aashish for the quick response.

Your response has provided one more option for me - to run workers on VM instances and run manager on Host.

I was thinking of using multiple options and was not sure which one to go for:

1. Using [Daemonlogger](http://sourceforge.net/projects/daemonlogger/) for capturing traffic from bridged interfaces and feeding this traffic to Bro.

2. Using [OpenvSwitch](http://openvswitch.org/) to achieve bridge functionality and feed it to Bro. From the docs, it is seen that [OVSDB](https://tools.ietf.org/html/rfc7047) supports full virtual switch management functionality.

I wanted to know if anybody in Bro Community had implemented similar solutions and wanted to know their experiences/feedback.

regards,

- Pradyumna Joshi

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [October 19, 2015, 5:34pm UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870/4 "2015-10-19T17:34:16Z")

</div>

Adding a little to this, we just started playing with running Bro on a VM to monitor VM-to-VM traffic on a HP bladesystem running VMWare using the port mirroring that Shane mentioned. It’s going well enough that I’m considering deploying it on all the other bladesystems as well.

Actually, we’re using it as a monitoring point for VM to non-VM traffic as well since it sees everything coming in-out of the chassis as well.

-Dop

---

<div class="post-metadata">

**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\
**Post date:** [October 19, 2015, 5:43pm UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870/5 "2015-10-19T17:43:11Z")

</div>

I think openswitch and port mirroring that Shane mentioned look like very promising options. Much better than clusterify the virtual machines.

While, I haven't run bro on VM systems, I would be very interested in the performance numbers, if any of you have those in future, please do share.

Thanks,  
Aashish

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-host/3870/6 "2022-05-06T15:43:09Z")

</div>