Open the Hyper-V Manager.
The New Virtual Machine Wizard opens.
Go to Specify Name and Location and type a name for your new virtual machine
Click Next .
Choose Generation 1 for this virtual machine and click Next.
Change the value of the Startup Memory
Click Next.
Select the network adapter to the network you want to monitor and click Next.
Select Use an existing virtual hard disk and click Browse to locate the Hyper-V VHD file.
Select the Sheriff CSM virtual machine that you created and click Settings.
A new window opens.
Click Processor in the left panel,
Click Apply .
Click Add Hardware > Network Adapter > Add to add network interfaces. Note: Sheriff CSM All-in-One supports 6 network interfaces and Sheriff CSM Remote Sensor supports 2 network interfaces. Sheriff recommends that you have at least two network interfaces, one for management and the other for network IDS.
(Optional) If using VLAN, in VLAN ID , select Enable virtual LAN identification and specify the VLAN ID in the box.
In Bandwidth Management , leave the option unchecked since enabling bandwidth management introduces the risk of packet loss.
Click Apply .
Repeat Steps 4 through 7 to add more network interfaces.
Locate Mirroring mode in the Port mirroring section, select Destination, and then click OK.
To setup virtual switches in promiscuous mode for monitoring external traffic, run the following:
$portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28-951f524251b5 $portFeature.SettingData.!MonitorMode = 2 Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <mySwitch> -VMSwitchExtensionFeature $portFeature
where
<mySwitch>
denotes the name of the virtual switch.
With this example, all traffic going through the virtual switch will be mirrored to any VM whose mirroring mode has been set to "Destination".
Alternatively, to setup virtual switches in promiscuous mode for monitoring internal traffic, run the following:
$portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28-951f524251b5 $portFeature.SettingData.!MonitorMode = 2 Add-VMSwitchExtensionPortFeature -ManagementOS -VMSwitchExtensionFeature $portFeature
Note: The -ManagementOS option does not allow you to specify a switch, so all virtual switches, including the shared management NIC port, will be set in monitoring mode.
To setup virtual switches in promiscuous mode for monitoring both internal and external traffic, run the following:
$portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28-951f524251b5 $portFeature.SettingData.!MonitorMode = 2 Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <mySwitch> -VMSwitchExtensionFeature $portFeature Add-VMSwitchExtensionPortFeature -ManagementOS -VMSwitchExtensionFeature $portFeatureNote: In the steps above, MonitorMode 0 = None, 1 = Destination, and 2 = Source.
Select your virtual machine and click Start on the right panel.