How to Set HyperV NIC in Promiscuous Mode

Question

Is there any way to set up a NIC on a virtual HyperV guest in promiscuous mode?
I want to try and run a web filtering product on a VM. Wireshark does not indicate that it is capturing all traffic.
I have my switch port mirrored already and it works with a regular box but not with the VM.
Any help would be appreciated.
Thanks,
Andy

Answer 1

I was able to make wireshark capture all the packets.
I followed this post:
   http://fixmyitsystem.com/2013/08/Remote-Wireshark.html
The only diference is that use and Internal Virtual Network  to connect from the
guest to the host.
My hyper-v host IP, for this network is 169.254.107.1 (check yours by doing ipconfig)
and the Guest is 169.254.107.20
Steps:
  - Just get rpcapd (http://nmap.org/dist/nmap-6.40-win32.zip).
  - Unzip it and install it on the hyper-v host
    Open PowerShell
    Enter-pssession Coremachine    
    Silently install: winpcap-nmap-4.02.exe /S
  - Next up you will have to create a firewall exception for
    this to be reachable from the management machine.
    netsh advfirewall firewall add rule name="Remote WinPcap" dir=in action=allow protocol=TCP localport=any remoteip=169.254.107.20
    (to turn on  the rule) netsh advfirewall firewall set rule name="Remote WinPcap" new enable=yes
    (to turn off the rule) netsh advfirewall firewall set rule name="Remote WinPcap" new enable=no
  - Navigate to C:\Program Files\WinPcap
    To start to packet capture service use
        .\rpcapd.exe -p 2002 -n
  - Get the GUID of the network card you want to use in WireShark  
      wmic nic where PhysicalAdapter="TRUE" get Description,GUID,MACAddress,Name,NetConnectionID
  - on wireshark
    Select Capture Options
    Click Manage Interfaces
    Select Local Interfaces tab and check the Hide box next to all of them
    Select remote Interfaces tab
    Click add button
    For the host specify the hostname or IP Address  
        (I use an internal network to conect to the host)
         My host IP is 169.254.107.1 and the Guest is 169.254.107.20
    The port default is 2002 (set with the -p switch earlier)
    Null authentication as set with the -n switch earlier
    OK
    You should now see a number of interfaces added
    Click Close
  - There will be a buffer size warning but it can be ignored, and hey presto,
    you are capturing packets from a remote  non GUI machine.  
    The process from here on in is the same as you would use WireShark with
    local traffic capture.