Revision history [back]

It can work with limitations and the correct software. By default, VM server only sees traffic for its virtual MAC address and multicast. If your VM box supports a VM switch, then it is possible to mirror traffic to another port in the same box. I would try performance and malware software to determine what needs to be capture. If is a requirement to capture all network traffic, then a dedicated network appliance is a better option.

Some limitations

1. Packet drops when the aggregate traffic exceeds the VM server port. An example of aggregate traffic issue is a 1G ingress/egress mirror. A 1G full duplex is simultaneous 1G ingress and 1G egress or 2G. The 2G aggregate traffic will never fit a 1G target port. Either two 1G target ports or 10G target port.
2. VM server will need to be able capture and write traffic a port speed to a file. If it can't then packets will be dropped.
3. File storage. There will be Terabytes of data.