Best Practices for Packet capturing on VMs

[sandhuramandeep]

Hello,

We have a real-time monitoring s/w that captures packet on a 1Gig network and analyzes them. It is capable of monitoring 800 Mbps of network traffic. We are planning to support the software on VMWare and we did some initial testing and following are our observations :

• By creating VMs with bridged network adapters, we experienced heavy packet loss.
• Then we chose the pass-through mode for the network adapter and saw much better results. Upto 250 Mbps we are not seeing any packet loss but for bitrates greater than that there is intermittent packet loss that happens every 30 mins/1 hour. (If we run the same s/w on a normal Windows machine, we do not experience packet loss upto 800 Mbps.)

We are stuck at this point and unware of any more optimizations that we can do in the VM setup. Any help in this direction will be greatly appreciated.

P.S. : We are using VMWare ESXi 5.5.0

[vm7user]

You use port mirroring on a Distributed Switch?

[sandhuramandeep]

Can you please elaborate more on this(I am not that familiar with port mirroring). Our setup is as follows :

There is a managed switch in the n/w.

2 machines A and B are attached to this switch.

A is the streamer machine which is streaming multicast feeds and B is a VMWare machine capturing these feeds (6-Core 3.4 GHz 16 GB with 2 NICs)

There is only one VM setup on the machine B which is running Windows 7 and connects to one of the NICs through pass through mode.

[rcporto]

I recommend you read about Port Mirroring feature of vSphere and check if will helps you: vSphere 5.1 – VDS Feature Enhancements - Port Mirroring - Part 1 | VMware vSphere Blog - VMware Blog...

[sandhuramandeep]

Hello Richardson,

I went through the link. It seems more useful for cases where the application is monitoring the entire network traffic. However, in our case ours is a real time content monitoring s/w that monitors Transport streams coming over UDP being streamed in MULTICAST/UNICAST mode. I don't think port mirroring would help us in this case. Thanks for the suggestion though 🙂