Prepare the Network Sensor VM on Nutanix AHV

The network sensor’s capture NIC is created as a Traffic Mirroring destination vNIC (aCLI type kSpanDestinationNic) on the sensor VM.

Carry out the following steps once, regardless of which configurations you use.

Step 1: Identify the Sensor VM

SSH into a Controller VM (CVM) and run:

acli vm.list

Note the sensor VM’s name and UUID from the output.

Step 2: Create the Traffic Mirroring Destination vNIC

Create a dedicated vNIC on the sensor VM to receive mirrored traffic. Do not pass any other parameters to this command:

acli vm.nic_create <sensor-vm-name> type=kSpanDestinationNic

Retrieve the MAC address of the new vNIC, which you will need to create the mirror session:

acli vm.nic_get <sensor-vm-name>

Find the entry where type is kSpanDestinationNic and note its mac_addr value. This is referenced as <capture-nic-mac> in the configuration articles.

Step 3: Pin the Sensor VM to Its Host

Traffic Mirroring generally requires the source and destination to be on the same AHV host. Exceptions are noted in each configuration article.

To stop the sensor VM migrating away from that host, configure it as an agent VM:

acli vm.update <sensor-vm-name> agent_vm=true

Step 4: Identify the AHV Host UUID

You will need the UUID of the AHV host hosting your traffic source and the sensor VM for Configuration A:

acli host.list