- I am using a Host machine whose OS is Win XP and I installed a Virtual Machine VMware supporting Win server 2003 R2.
- Orion NPM and NTA are installed on the VM machine.
- My VM machine has been automatically configured in Bridged mode (other choices are NAT mode and Host-only mode).
- On Win XP host machine, network connections are: VMNet1, VMNet 8 and LAN. (VMnet0 is not displayed because this is a level 2 connection (and not level 3). But it does exist and corresponds to Bridged mode).
- On VM guest machine, Orion detects 3 interfaces, VMnet1, VMNet8 and TCP localhost.
I am using a Netflow generator to send Netflow packets containing data related to UDP flows mainly. They are collected and displayed within Orion NTA, but:
- They are displayed in charts linked to interface VMNet 8 (VMNet8 is the virtual interface used for NAT mode nominally).
- Sometimes randomly, I can see these data displayed in charts linked to VMNet1 (interface used for host-only mode).
- Some other times, I can see data being displayed in charts of both virtual interfaces at the same time (i.e. VMNet1 and 8)!
Why Netflow packets sent in Bridged mode are displayed in Orion for VMNet8 interface (VMNet1 sometimes)?
Is there an explanation?