Why does a KVM guest not receive all network traffic sent to the bridge?
Issue
- Want to perform network traffic analysis (e.g. tcpdump or wireshark) from a KVM virtualisation guest.
- Traffic delivered to a bridge.
- KVM guest does not receive all traffic, only traffic addressed to it and broadcast traffic.
- The bridge is acting as a switch not as a hub.
Environment
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 5
- KVM virtualization
- Bridged networking with
bridge
driver, such asbr0
orvirbr0
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.