Options to monitor/sniff network traffic under a vm

[John Nielsen]

On Aug 25, 2013, at 5:38 AM, carlopmart <carlopmart at gmail.com> wrote:

> I need to monitor/sniff network traffic for three subnets (1 GiB nets) and I need to do this using a virtual guest under an ESXi 5 host (yes, it is a "handicap").

Not sure about your questions below, but doesn't ESXi 5 support port mirroring in the virtual switch? That seems like a better place to do most of the heavy lifting. You could still attach your FreeBSD instance to the monitor port(s) for analysis. That would hopefully help at least with a) by reducing the number of virtual NICs needed.

> I would like to use FreeBSD 8.4 + netmap, but I see some problems:
> 
> a) How can I avoid sharing interrupts for nics interfaces?? This vm needs to use 6 nic interfaces.
> 
> b) Which is best: em or ixgb emulated drivers??
> 
> c) Is it a good idea to enable polling in these nics??