Forwarder Node not collecting all network traffic

[nation1989]

In an air-gapped environment, we have a vCenter Virtual Distributed Switch (VDS) configured in promiscuous mode. Among the nodes connected to this VDS, we have two specific ones: a node running Wireshark and a forwarder node, alongside other servers fulfilling various functions. While conducting a Wireshark capture, we observe network traffic from the other servers on the VDS, but we do not detect the same network traffic originating from the forwarder node. Are there any additional configurations required to capture all network traffic on the VDS? It is worth noting that the forwarder node utilizes the homenet filters from the master node, which encompass all the networks we aim to monitor.

[dougburks]

Have you checked the VMware section of our documentation?
https://docs.securityonion.net/en/2.3/vmware.html#esxi