Configuration A: North-South Traffic Monitoring

North-south traffic crosses the AHV host’s physical uplink. For example, traffic between VMs and the corporate network or the internet.

The source of the mirror session is the host’s uplink bond port, such as br0-up. The destination is the capture vNIC you created in Prepare the Network Sensor VM.

Identify the Source Port Name

Determine the name of the uplink bond port on the AHV host, which is typically br0-up. To confirm, SSH into the AHV host and run:

ovs-vsctl show

Look for the bond port associated with the physical uplink NICs. Note the port name, which is referenced as <uplink-port> below.

Create the Traffic Mirroring Session

From a CVM, run:

acli net.create_traffic_mirror r7_north_south \
  description="Rapid7 north-south monitoring" \
  source_list={uuid=<ahv-host-uuid>,type=kHostNic,identifier=<uplink-port>,direction=kBiDir} \
  dest_list={uuid=<sensor-vm-uuid>,type=kVmNic,identifier=<capture-nic-mac>}

Set direction to kIngress for inbound-only, kEgress for outbound-only, or kBiDir for both directions.

Verify

acli net.list_traffic_mirror

Confirm that r7_north_south is listed with State kActive. For full session details, including traffic counters:

acli net.get_traffic_mirror r7_north_south

Legacy Alternative: OVS Mirror

If aCLI Traffic Mirroring is unavailable because AOS is older than 6.0, you can achieve the same result by manipulating OVS directly. If the cluster is registered to Prism Central, do not use this method. Configure Traffic Mirroring through the Prism Central UI or v4 API instead.

ovs-vsctl \
  -- --id=@s get port <uplink-port> \
  -- --id=@d get port <capture-tap> \
  -- --id=@m create mirror name=r7_ns_mirror \
       select-src-port=@s select-dst-port=@s output-port=@d \
  -- add bridge <bridge> mirrors @m

<capture-tap> is the tap interface corresponding to the sensor VM’s capture NIC. Match its MAC address with virsh domiflist <sensor-vm-uuid> on the AHV host.

The mirror selects only the uplink port, so VM-to-VM traffic on the same bridge is not captured. Avoid select-all=true, which mirrors every port on the bridge, including VM tap ports.