Configuration B: East-West Traffic Monitoring

East-west traffic flows between VMs on the same AHV host and never reaches the physical uplink. For this configuration, the source of the mirror session is the vNIC of each monitored VM.

Identify Source VM NICs

For each VM whose traffic you want to monitor, get its vNIC MAC address:

acli vm.nic_get <source-vm-name>

Note the mac_addr of the vNIC to monitor, and the VM’s UUID from acli vm.list.

Up to 4 source entities are supported in a single session. VMs, host NICs, and bonds can be mixed.

Create the Traffic Mirroring Session

acli net.create_traffic_mirror r7_east_west \
  description="Rapid7 east-west monitoring" \
  source_list={uuid=<source-vm-uuid>,type=kVmNic,identifier=<source-vnic-mac>,direction=kBiDir} \
  dest_list={uuid=<sensor-vm-uuid>,type=kVmNic,identifier=<capture-nic-mac>}

To add a second source VM to the same session, separate additional source entries with a semicolon (no space) inside source_list, each with its own curly-brace block.

Verify

acli net.list_traffic_mirror

Confirm that r7_east_west shows State kActive. If it shows kError, the source and destination VMs are most likely not on the same host. See the host placement requirements above.

Legacy Alternative: OVS Mirror

Where aCLI Traffic Mirroring cannot be used, you can achieve the same result directly with OVS.

ovs-vsctl \
  -- --id=@s1 get port <source-tap-1> \
  -- --id=@d get port <capture-tap> \
  -- --id=@m create mirror name=r7_ew_mirror \
       select-dst-port=@s1 select-src-port=@s1 output-port=@d select-all=false \
  -- add bridge <bridge> mirrors @m

Add further --id=@sN get port <tap-name> entries, and their references in select-dst-port and select-src-port, for additional source VMs. Tap interface names are found by matching each VM’s vNIC MAC address with virsh domiflist <vm-uuid> on the AHV host.