Capturing data packets for analysis using a virtual machine

1. A method comprising:

by program instructions on a computing device,

receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a mirrored data packet with a data packet header, and wherein the analyzer virtual machine is one of a plurality of virtual machines hosted on the computing device;

stripping, by the analyzer virtual machine, the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header; and

directing, by the analyzer virtual machine and based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine for analysis by the packet capture application.

2. The method of claim 1 , wherein directing the de-encapsulated packet to the virtual network interface associated with the packet capture application within the analyzer virtual machine comprises:

filtering the de-encapsulated packet based on the data packet header; and

sending, based on the filtering, the de-encapsulated packet to the virtual network interface.

3. The method of claim 1 , wherein the virtual network interface is one of a plurality of virtual network interfaces on the analyzer virtual machine, wherein the packet capture application operates within an application layer of the analyzer virtual machine, and wherein each of the plurality of virtual network interfaces operate at a kernel layer of the analyzer virtual machine.

4. The method of claim 3 , wherein each of the plurality of virtual network interfaces is associated with a different packet capture application within the analyzer virtual machine.

5. The method of claim 1 , wherein the de-encapsulated packet is directed to the virtual network interface based on a port identified in the data packet header.

6. The method of claim 1 , wherein the monitoring metadata header is used by a host of the analyzer virtual machine to direct the encapsulated packet to the analyzer virtual machine.

7. The method of claim 1 , wherein the analyzer virtual machine receives the encapsulated packet via a virtual network.

8. An apparatus comprising a computing device, a computer processor, and a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a mirrored data packet with a data packet header, and wherein the analyzer virtual machine is one of a plurality of virtual machines hosted on the computing device;

stripping, by the analyzer virtual machine, the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header; and

directing, by the analyzer virtual machine and based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine for analysis by the packet capture application.

9. The apparatus of claim 8 , wherein directing the de-encapsulated packet to the virtual network interface associated with the packet capture application within the analyzer virtual machine comprises:

filtering the de-encapsulated packet based on the data packet header; and

sending, based on the filtering, the de-encapsulated packet to the virtual network interface.

10. The apparatus of claim 8 , wherein the virtual network interface is one of a plurality of virtual network interfaces on the analyzer virtual machine, wherein the packet capture application operates within an application layer of the analyzer virtual machine, and wherein each of the plurality of virtual network interfaces operate at a kernel layer of the analyzer virtual machine.

11. The apparatus of claim 10 , wherein each of the plurality of virtual network interfaces is associated with a different packet capture application within the analyzer virtual machine.

12. The apparatus of claim 8 , wherein the de-encapsulated packet is directed to the virtual network interface based on a port identified in the data packet header.

13. The apparatus of claim 8 , wherein the monitoring metadata header is used by a host of the analyzer virtual machine to direct the encapsulated packet to the analyzer virtual machine.

14. The apparatus of claim 8 , wherein the analyzer virtual machine receives the encapsulated packet via a virtual network.

15. A computer program product including a non-volatile computer readable storage medium and computer program instructions stored therein that, when executed, cause a computer to carry out the steps of:

receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a mirrored data packet with a data packet header, and wherein the analyzer virtual machine is one of a plurality of virtual machines hosted on a virtualization platform on a computing device;

stripping, by the analyzer virtual machine, the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header; and

directing, by the analyzer virtual machine and based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine for analysis by the packet capture application.

16. The computer program product of claim 15 , wherein directing the de-encapsulated packet to the virtual network interface associated with the packet capture application within the analyzer virtual machine comprises:

filtering the de-encapsulated packet based on the data packet header; and

sending, based on the filtering, the de-encapsulated packet to the virtual network interface.

17. The computer program product of claim 15 , wherein the virtual network interface is one of a plurality of virtual network interfaces on the analyzer virtual machine, wherein the packet capture application operates within an application layer of the analyzer virtual machine.

18. The computer program product of claim 17 , wherein each of the plurality of virtual network interfaces is associated with a different packet capture application within the analyzer virtual machine.

19. The computer program product of claim 15 , wherein the de-encapsulated packet is directed to the virtual network interface based on a port identified in the data packet header.

20. The computer program product of claim 15 , wherein the monitoring metadata header is used by a host of the analyzer virtual machine to direct the encapsulated packet to the analyzer virtual machine.