How to Configure Hyper-V Virtual Switch Extensions in Windows 11 Using PowerShell

The Hyper-V Extensible Switch in Windows 11 provides a modular software-defined networking platform that connects virtual machines to physical and virtual network adapters. Operating at Layer 2 of the OSI model, the virtual switch supports custom third-party and built-in plug-in drivers known as Virtual Switch Extensions. Through extensible NDIS (Network Driver Interface Specification) filter drivers, administrators and security software can intercept, monitor, modify, and route network packets directly within the hypervisor packet datapath before frames reach guest operating systems. Using Windows PowerShell, systems engineers can audit active switch extensions, enable security filters (such as Microsoft Windows Filtering Platform), and control extension binding order across internal and external virtual switches.

Architecture of the Hyper-V Extensible Switch Pipeline

The Hyper-V extensible switch organizes extensions into a deterministic, layered processing pipeline divided into three architectural tiers:

• Capture Extensions: Non-intrusive monitoring drivers that inspect network traffic without modifying or dropping packets. Ideal for network packet capture tools, sFlow agents, and intrusion detection systems (IDS). Multiple capturing extensions can run simultaneously.
• Filtering Extensions: Security and traffic-shaping drivers that inspect and conditionally drop or modify packets. Examples include the built-in Microsoft Windows Filtering Platform (WFP), which implements port ACLs, stateful inspection, and firewall policies. Multiple filtering extensions can coexist in priority order.
• Forwarding Extensions: The most powerful tier. Completely supersedes the native Layer 2 forwarding logic of the Hyper-V switch, determining destination switch ports for incoming packets. Only a single forwarding extension can be active on a virtual switch at any time (e.g. Cisco Nexus 1000V or Open vSwitch drivers).

Auditing Available and Enabled Switch Extensions in PowerShell

To inspect all extensible switch drivers installed on your Windows 11 host and their operational status across specific virtual switches, open Windows PowerShell as an Administrator and query Get-VMSwitchExtension:

# List all extensions available on a target virtual switch
Get-VMSwitchExtension -VMSwitchName "ExternalSwitch" | Select-Object `
    Name, `
    ExtensionType, `
    Enabled, `
    RunningStatus, `
    Vendor

Key properties to evaluate include:

• ExtensionType: Displays the operational tier (Capture, Filter, or Forward).
• Enabled: Indicates whether the extension is active on the designated switch instance.
• RunningStatus: Reflects the runtime driver health (Running, Stopped, or Degraded).

Inspecting Default Built-in Hyper-V Extensions

Windows 11 includes several native switch extensions by default:

• Microsoft Windows Filtering Platform: Provides core packet filtering, port security ACLs, and firewall evaluation.
• Microsoft NDIS Capture: Enables lightweight network packet sniffing and packet diagnostics directly from host command line utilities (such as pktmon or Netsh trace).
• Microsoft Azure VFP Switch Extension: Virtual Filtering Platform driver that accelerates SDN overlay routing in advanced container environments.

Enabling and Disabling Switch Extensions via PowerShell

To toggle specific extensions on an existing virtual switch without terminating connected virtual machines or resetting network adapters, use Enable-VMSwitchExtension and Disable-VMSwitchExtension.

To enable the Microsoft NDIS Capture extension on an internal development switch for packet capture analysis:

Enable-VMSwitchExtension -VMSwitchName "InternalDevSwitch" -Name "Microsoft NDIS Capture"

To disable an unwanted or conflicting filtering extension:

Disable-VMSwitchExtension -VMSwitchName "InternalDevSwitch" -Name "Microsoft Azure VFP Switch Extension"

To verify the state change immediately:

Get-VMSwitchExtension -VMSwitchName "InternalDevSwitch" | Select-Object Name, Enabled

Managing Extension Layering and Ordering

When multiple filtering extensions are active on a single virtual switch, the order in which packets traverse the extensions determines security policy outcomes. If an intrusion prevention filter must inspect packets before an encryption filter processes payloads, administrators can adjust extension order.

To inspect and modify the extension processing order:

# Inspect current extension order
Get-VMSwitchExtension -VMSwitchName "ExternalSwitch" | Sort-Object Order | Select-Object Order, Name, ExtensionType

# Set the ordering priority of an extension
Set-VMSwitchExtensionOrder -VMSwitchName "ExternalSwitch" `
    -FilteringExtensionOrder @("Microsoft Windows Filtering Platform", "ThirdPartyFilterExtension")

Troubleshooting Extensible Switch Performance Bottlenecks

Misconfigured or outdated third-party switch extensions can introduce severe latency or packet drops. If network throughput collapses after installing a network monitoring agent:

• Audit dropped frame metrics in the Hyper-V Event Log under Microsoft-Windows-Hyper-V-Vmswitch-Operational.
• Temporarily disable non-essential capturing extensions to isolate whether driver queue buffers are saturating CPU cores:

  Get-VMSwitchExtension -VMSwitchName "ExternalSwitch" | Where-Object { $_.ExtensionType -eq "Capture" } | Disable-VMSwitchExtension

• Re-test virtual machine bandwidth throughput using iperf3 or SMB file transfers.

Leveraging Hyper-V Virtual Switch Extensions in Windows 11 enables network engineers to deploy sophisticated SDN security, hardware-accelerated filtering, and native traffic capture directly within the hypervisor datapath.