You know what they say about making assumptions?
This should apply doubly to Microsoft software.
Getting all excited about trying out the new release of Security Onion, I setup a SPAN on my core switch, and sent it to a virtual NIC on my new Hyper-V server. For some reason, I could see the traffic on the host OS, but never on the guest OS.
After doing some searching online, I found out that, unlike VMware and ESXi, Hyper-V does not support Promiscuous Mode.
That really sucks.
Microsoft, your forcing my hand…. Back to ESXi for my network monitoring server.
-Josh
Defensive Depth 
MS has something similar they allow you to mirror the traffic of a guest nic to another guest nic but they do not have a switch level option unless you use a adv virtual switch like the Cisco nexus 1000
LikeLike