Hyper-V SET virtual switch - drops 90% of mirrored packets.

Question

Hyper-V SET virtual switch - drops 90% of mirrored packets.

Ben Steiner 40

Hello,

We have a Hyper-V SET virtual switch that is dropping 90% of mirrored packets when monitoring network traffic for a security VM. It only forwards a small fraction of the expected network traffic. However, there is no clear documentation on how we can tune the virtual switch port mirror modes and buffer limits via PowerShell.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

The packet loss you’re seeing is expected behavior: Hyper‑V Switch Embedded Teaming (SET) does not reliably support full port mirroring. The SET load‑balancing mechanism only mirrors traffic traversing certain paths, which explains why your security VM receives less than 10% of the packets. There is no PowerShell parameter to tune buffer limits or force complete mirroring in SET.

In detail, Hyper‑V port mirroring works at the vSwitch layer, duplicating traffic from a source vNIC to a destination vNIC. When you enable SET, traffic is distributed across multiple physical NICs, and the mirroring process only captures flows that traverse the same path through the vSwitch pipeline. This results in heavy packet loss for mirrored traffic. Microsoft’s documentation and field experience confirm that SET is not designed for accurate traffic monitoring; it is optimized for throughput and resiliency, not packet visibility.

You can verify your configuration with PowerShell. Run Get-VMNetworkAdapter -VMName <SourceVM> and check that PortMirroring is set to Source. On the security VM, confirm PortMirroring is set to Destination. If needed, adjust with Set-VMNetworkAdapter -VMName <VM> -PortMirroring Source|Destination. To further confirm where packets are being dropped, use Get-NetAdapterStatistics on each SET member NIC to see if mirrored traffic is unevenly distributed. Also, disable SR‑IOV, VMQ, and RSS on the capture NIC to ensure traffic is processed through the vSwitch rather than bypassed by hardware offload.

However, even with correct configuration, you cannot eliminate the 90% drop in SET environments. Hyper‑V does not expose buffer or queue tuning for port mirroring, and there is no supported registry or PowerShell tweak to change this. If you require reliable full packet visibility, the recommended approach is to create a dedicated non‑SET vSwitch for monitoring, or use an external hardware TAP/SPAN solution connected to your physical switch. This ensures the security VM receives complete mirrored traffic without relying on SET’s limited mirroring behavior.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HL.