Court-recording staff want a packet-capture virtual machine to see every frame on its port group, not only frames addressed to that virtual machine. Which vSphere networking setting is that request?

Court-recording staff who need a packet-capture virtual machine to see every frame on its port group—not only frames addressed to that VM—are asking for promiscuous mode on the vSphere port-group security policy. Promiscuous mode is a security-camera setting on the vSphere jack: when enabled, the capture VM may receive all frames on that port group for analysis. An NSX Distributed Firewall allow-any rule permits traffic that would otherwise be blocked; it does not make a guest see frames not destined to it on a vSphere port group. An NSX gateway-firewall identity rule is an identity-based north-south or gateway policy concept, not the vSphere port-group security switch for sniffing. A VMkernel adapter enabled for vMotion carries host live-migration service traffic and does not grant a guest promiscuous visibility on a VM port group. Exam caveat: promiscuous mode, MAC address changes, and forged transmits are the classic vSphere port-group security trio; enabling promiscuous mode has security implications and is usually limited to capture or nested environments. It is not a substitute for proper SPAN or monitoring design in every civic case. Operational check: enable promiscuous mode only on the capture port group (or a dedicated capture network), attach the capture VM, and confirm it receives broadcasts and other hosts’ frames on that group; leave production port groups restrictive unless a documented exception exists.