We've been experiencing some issues with port mirroring that is used by a Network Intrusion detection system. Our company uses AlienVault as a SIEM and uses a Hyper-V sensor which is used to forward data to the SIEM. The Sensor uses 5 virtual adapters (eth 0 to eth4). The eth 0 is used for management traffic which includes vulnerability scanning. The other ethernet ports are used for port mirroring. I have configured the port mirroring to detect traffic from a VLAN and doing network traffic analysis, I observed that there is no TCP, UDP traffic. Only DHCP and RSTP traffic could be seen
Any suggestions from you guys as to how to solve this issue would be great.