Network sniffing with Virtual PC / Virtual Server

Is not a good idea.  Sorry.  Every now and then someone asks me whether Virtual PC / Virtual Server can be used to run network sniffing applications to perform analysis of general network traffic – and the answer is ‘Yes and no and not really’.

The ‘Yes’ part is that Virtual PC / Virtual Server do support having the virtual network card put into promiscuous mode and can run network sniffing applications to gather any network traffic going by.

The ‘No’ part is because the virtual network created for virtual machines acts like a network hub with a switched uplink connection.  This means that the virtual machine will only see network traffic that is headed for virtual machines connected to the same virtual network as itself.  It will not see network traffic that is headed for the host operating system, or for any other physical computers on the network.

This is a show stopper for most people – as they are usually interested in monitoring network traffic between physical computers, not virtual machines.