Hyper-v v-NIC has span traffic issue.

Hello Songchai,

The behavior you are seeing is expected when using Hyper‑V port mirroring in destination mode. The virtual NIC configured as a mirror destination will only receive traffic that the vSwitch can forward, but it does not replicate every single packet seen on the physical NIC. In particular, Hyper‑V’s port mirroring is limited to traffic that traverses the vSwitch. Frames that are handled entirely in the host stack, or offloaded by the NIC hardware, may not be mirrored into the VM. That explains why Wireshark on the VM shows fewer IP addresses than a capture on the physical NIC.

To maximize visibility, you need to ensure that the vSwitch is bound to the correct physical adapter and that the span traffic from the Cisco switch is actually entering the vSwitch pipeline. If the span is delivered to the host NIC but bypasses the vSwitch (for example, due to SR‑IOV or hardware offload features), the VM mirror destination will not see it. Disabling SR‑IOV on the vSwitch and turning off certain offloads such as VMQ or RSS for the capture NIC can help force traffic through the vSwitch path. You should also confirm that the VM’s vNIC is explicitly set to “Port Mirroring Mode: Destination” in its advanced settings, and that the source vNICs or external vSwitch ports are set to “Port Mirroring Mode: Source.” Without both ends configured, the mirror will be incomplete.

If your goal is to replicate the full physical NIC view, Hyper‑V port mirroring alone will not achieve it. The vSwitch only mirrors traffic it processes, not all traffic received by the adapter. For complete visibility, you would need to capture directly on the physical NIC using tools like Microsoft Network Monitor or Wireshark with NDIS capture, or use a dedicated capture appliance connected to the Cisco span port. Hyper‑V port mirroring is best suited for intra‑VM and vSwitch traffic analysis, not full physical span replication.

In short, the discrepancy you are seeing is by design. To tune the VM to receive more of the span traffic, disable SR‑IOV and offloads on the vSwitch NIC, ensure proper source/destination port mirror configuration, and accept that some traffic handled outside the vSwitch path will not be visible inside the VM. For full parity with the physical NIC capture, you need to capture at the host NIC level rather than relying on Hyper‑V port mirroring.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.