Figure 9 - Virtual Deployment

In the figure above, a virtual switch with mirror port capabilities is used to capture traffic and a separated VM acts as a sniffer, managed over a dedicated pNIC.

• 
  Easy deployment
  

• 
  Not all vSwitches support mirror ports.
  
• 
  The sniffer VM might generate high load on the host (in particular if some analysis, de-duplication or correlation scripts are active).
  
• 
  If the hypervisor is compromised, the sniffer can no longer be trusted.