I worked with our network team to set up a SPAN and our VMware team to build a promiscuous mode vswitch for us to do some DPI testing. When I check the vNIC in the guest OS (Windows 2008 R2) --- nothing. No packets. Talked with the network guy who said we didn't need an IP address. "OK," I thought, "time to pull out the big guns." I installed WireShark on the VM and BANG, loads of traffic when I do a WireShark capture.
What am I missing in the native OS to get it see traffic without running WireShark?