Promiscuous mode, Mac address changes, Forged transmit

Physical Environment

 

L2 switch with 4 ports and a NIC(MAC 2) connected

 

How to capture traffic( Source MAC 1, Dest MAC 3 ) at MAC 2

 

Solutions : Port Mirroring, Promiscuous Mode

 

Promiscuous Mode : allow and disallow all traffic to be forwarded, regardless of the destination

 

Virtual enviroment

 

1. Packet Capture Tools

2. IDS / IPS (VM)

3. Hypervisor on VM

 

Nested Virtualization Enviroment

 

external vSwitch(ESXi) doesn't recognize that MAC addr of internal NIC

therefore needed promiscuous mode

 

MAC Address Changes, Forged Transmits

 

How to Change MAC addr : NIC properties > Advanced > Locally Administered Address > Value