How to Configure Hyper-V Virtual Switch Port Mirroring in Windows 11 Using PowerShell

Analysing network packets within virtualised environments is essential for diagnosing application protocol errors, investigating security anomalies, and auditing compliance. In Microsoft Hyper-V on Windows 11 Pro and Enterprise, network packet inspection cannot rely on physical switch SPAN ports when communication occurs between virtual machines on the same virtual switch. Hyper-V solves this through Virtual Switch Port Mirroring, allowing administrators to capture, mirror, and forward inbound and outbound frame copies from one or more virtual machine network adapters to a dedicated packet analyser instance running Wireshark or an intrusion detection system (IDS). Configuring this capability via PowerShell provides precise control over traffic mirroring modes without disrupting active virtual machine workloads.

Hyper-V Port Mirroring Architecture and Modes

Hyper-V implements port mirroring at the virtual switch filtering layer (NDIS lightweight filter). When an adapter is configured for port mirroring, the virtual switch replicates raw Layer 2 Ethernet frames passing through the virtual switch port and transmits them to designated destination monitoring ports.

Hyper-V supports three distinct operational port mirroring modes:

• None: The default state. The virtual network adapter transmits and receives only traffic directly addressed to its MAC address, multicast groups, or broadcast requests.
• Source: The monitored virtual network adapter. The virtual switch copies all incoming (ingress) and outgoing (egress) frames passing through this adapter and routes duplicate frames to the monitoring destination.
• Destination: The monitoring virtual network adapter. The virtual machine attached to this adapter operates its virtual network card in promiscuous capture mode, ingesting mirrored frames for protocol analysis.

Auditing Existing Hyper-V Virtual Machines and Adapters

Before configuring port mirroring, verify the exact names of your virtual machines, virtual switches, and attached virtual network adapters using elevated PowerShell:

# List all local Hyper-V virtual machines and their execution state
Get-VM | Select-Object Name, State, MemoryAssigned, Uptime

# Audit virtual network adapters and their current port mirroring mode
Get-VMNetworkAdapter -VMName * | Select-Object VMName, Name, SwitchName, MacAddress, PortMirroringMode

Confirm that both the target workload VM (traffic source) and the packet capture VM (traffic destination) are connected to the exact same Hyper-V Virtual Switch.

Configuring the Destination Monitoring Virtual Machine

To prepare the monitoring virtual machine (for example, a security sensor or a dedicated Wireshark VM named SecOps-Monitor), assign its virtual network adapter to operate as the capture destination:

# Set the virtual network adapter on the capture machine as Destination
Set-VMNetworkAdapter -VMName "SecOps-Monitor" -Name "Network Adapter" -PortMirroring Destination

# Verify that the PortMirroringMode successfully updated
Get-VMNetworkAdapter -VMName "SecOps-Monitor" | Format-List VMName, Name, PortMirroringMode

If the monitoring machine has multiple virtual network adapters, specify the exact adapter name to avoid directing captured traffic into your management interface.

Assigning Source Virtual Machines for Traffic Mirroring

Once the destination listener is configured, set the target virtual machine whose traffic requires inspection (for example, a web server VM named App-Web-01) to operate in Source mode:

# Configure the source virtual machine adapter for mirroring
Set-VMNetworkAdapter -VMName "App-Web-01" -Name "Network Adapter" -PortMirroring Source

# Verify the updated mirroring status on the source VM
Get-VMNetworkAdapter -VMName "App-Web-01" | Select-Object VMName, Name, PortMirroringMode

To mirror traffic from multiple virtual machines simultaneously to the same capture appliance, execute a pipeline command targeting all designated VMs:

# Assign multiple virtual machines as mirroring sources
$SourceVMs = @("App-Web-01", "App-API-02", "App-DB-01")
foreach ($VM in $SourceVMs) {
    Set-VMNetworkAdapter -VMName $VM -PortMirroring Source
}

Capturing Mirrored Packets in the Monitoring Virtual Machine

Log in to the destination monitoring virtual machine (SecOps-Monitor) to verify packet delivery:

1. Launch Wireshark or open an elevated terminal with pktmon or tcpdump.
2. Ensure promiscuous mode is enabled on the network interface inside the guest operating system.
3. Start capturing on the primary network interface. Generate network traffic on the source VM (such as an HTTP GET request or an ICMP ping).
4. Observe that raw Ethernet frames, ARP requests, TCP handshakes, and UDP datagrams originating from or addressed to the source VM appear in the capture window.

Configuring Advanced NDIS Port Mirroring via PowerShell

For complex network architectures requiring isolation between multiple mirrored groups, Hyper-V supports port mirroring profiles using the Add-VMNetworkAdapterExtendedAcl cmdlet. This allows administrators to mirror only specific IP subnets, VLAN IDs, or protocol ports:

# Create an extended ACL to mirror only HTTPS (port 443) traffic from a source VM
Add-VMNetworkAdapterExtendedAcl -VMName "App-Web-01" -Direction Both -Action Mirror -LocalPort 443 -Protocol TCP

# Inspect all active Extended ACL rules on the adapter
Get-VMNetworkAdapterExtendedAcl -VMName "App-Web-01"

Disabling Port Mirroring and Restoring Standard Operation

Leaving port mirroring active permanently incurs virtual switch CPU overhead and can saturate virtual network interfaces. Once diagnostics and packet captures are complete, reset the adapters to default operation:

# Revert the source VM adapter back to None
Set-VMNetworkAdapter -VMName "App-Web-01" -PortMirroring None

# Revert the destination monitoring adapter back to None
Set-VMNetworkAdapter -VMName "SecOps-Monitor" -PortMirroring None

# Remove any custom mirroring Extended ACLs
Remove-VMNetworkAdapterExtendedAcl -VMName "App-Web-01" -Action Mirror

Re-run Get-VMNetworkAdapter -VMName * | Select-Object VMName, PortMirroringMode to confirm that all virtual adapters have cleanly disengaged from the mirroring session.