{"id":35194940,"url":"https://github.com/mddazure/virtual-network-tap-lab","last_synced_at":"2026-04-01T21:51:03.286Z","repository":{"id":327768221,"uuid":"1109157239","full_name":"mddazure/virtual-network-tap-lab","owner":"mddazure","description":"Demonstration of Virtual Network TAP in Azure","archived":false,"fork":false,"pushed_at":"2025-12-05T16:02:20.000Z","size":701,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-27T23:41:52.635Z","etag":null,"topics":["bicep","vnet","vtap","vxlan","wireshark"],"latest_commit_sha":null,"homepage":"","language":"Bicep","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mddazure.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-03T12:19:50.000Z","updated_at":"2026-02-10T09:03:48.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/mddazure/virtual-network-tap-lab","commit_stats":null,"previous_names":["mddazure/virtual-network-tap-lab"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mddazure/virtual-network-tap-lab","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mddazure%2Fvirtual-network-tap-lab","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mddazure%2Fvirtual-network-tap-lab/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mddazure%2Fvirtual-network-tap-lab/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mddazure%2Fvirtual-network-tap-lab/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mddazure","download_url":"https://codeload.github.com/mddazure/virtual-network-tap-lab/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mddazure%2Fvirtual-network-tap-lab/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31292579,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-01T21:15:39.731Z","status":"ssl_error","status_checked_at":"2026-04-01T21:15:34.046Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bicep","vnet","vtap","vxlan","wireshark"],"created_at":"2025-12-29T06:58:42.198Z","updated_at":"2026-04-01T21:51:03.278Z","avatar_url":"https://github.com/mddazure.png","language":"Bicep","funding_links":[],"categories":[],"sub_categories":[],"readme":"# **Virtual Network TAP**\n\n[Azure Virtual Network Terminal Access Point](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview) (VTAP), in public preview in select regions, copies network traffic from source Virtual Machines to a collector or traffic analytics tool, running as a Network Virtual Appliance (NVA). VTAP creates a full copy of all traffic sent and received by Virtual Machine Network Interface Card(s) (NICs) designated as VTAP source(s). This includes packet payload content - in contrast to VNET Flow Logs which only collects traffic meta data. Traffic collectors and analytics tools are [3rd party partner products](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview#virtual-network-tap-partner-solutions), available from the Azure MArketplace, amongst which are the major Network Detection and Response solutions.\n\nVTAP is an agentless, cloud-native traffic tap at the Azure network infrastructure level. It is entirely out-of-band; it has no impact on the source VM's network performance and the source VM is unaware of the tap. Tapped traffic is VXLAN-encapsulated and delivered to the collector NVA, in the same VNET as the source VMs or a peered VNET. \n\n# Lab\nThis lab demonstrates the basic functionality of VTAP: copying traffic into and out of a source VM, to a destination VM. The lab consists of 3 three Windows VMs in one VNET, running a basic web server that responds with the VM's name. Another VNET contains the target - a Windows VM on which Wireshark is installed, to inspect traffic forwarded by VTAP. This lab does not use VTAP partner solutions from the Marketplace.\n\nThe VTAP resource in the lab is configured with the target VM's NIC as the destination, and one of the web server VMs as the source. Using a single source makes inspection of the traffic flows in Wireshark easier - the other VMs can be added as sources manually.\n\n![image](/images/vtap-lab.png)\n\n# Deploy\nLog in to Azure Cloud Shell at https://shell.azure.com/ and select Bash.\n\nEnsure Azure CLI and extensions are up to date:\n  \n      az upgrade --yes\n  \nIf necessary select your target subscription:\n  \n      az account set --subscription \u003cName or ID of subscription\u003e\n  \nClone the  GitHub repository:\n\n    git clone https://github.com/mddazure/virtual-network-tap-lab\n\n\nChange directory:\n\n    cd ./virtual-network-tap-lab/templates\n\nDeploy the Bicep template:\n\n      az deployment sub create --name vtap --location germanywestcentral --template-file main.bicep\n\nVerify that all components in the diagram above have been deployed to the resourcegroup `vtap-lab` and are healthy. \n\nCredentials:\n\nusername: `AzureAdmin`\n\npassword: `vnettap-2025%`\n\n# Observe\nLog on to `vm1` via Bastion and start the `loop.bat` batch file found on the Desktop. This will poll the web servers on the other VMs, and `ipconfig.io` on the internet, to generate network traffic.\n\nLog on to `vmtarget` via Bastion and install [Wireshark](https://www.wireshark.org/download.html), keeping the installer's default settings. \n\nStart Wireshark, enter `udp port 4789` in the Capture filter box and start the capture by clicking the shark's fin in the top left corner.\n\n![image](/images/wireshark-startup.png)\n\nThe filter on UDP port 4789 causes Wireshark to only capture the VXLAN encapsulated traffic forwarded by VTAP. Wireshark is configured to automatically decode VXLAN and it displays the actual traffic to and from `vm1`, which is set up as the (only) VTAP source. \n\n:point_right: Close the Bastion session to `vm1`, as the  traffic between the VM and Bastion is also captured and convolutes the Wireshark display.\n\nThe wireshark capture panel shows full TCP and HTTP exchanges, including the TCP handshake, between `vm1` and the other VMs, and https://ipconfig.io.\n\n![image](/images/wireshark-capture.png)\n\nThe lines in the detail panel below can be expanded to show the details of the VXLAN encapsulation. The outer IP packets, encapsulating the VXLAN frames in UDP, originate from the source VM's IP address and have the target VM's address as the destination.\n\nThe VXLAN frames contain all the details of the original Ethernet frames, and the IP packets within those, exchanged between `vm1` and the destinations it speaks with.\n\n![image](/images/wireshark-detail.png)\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmddazure%2Fvirtual-network-tap-lab","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmddazure%2Fvirtual-network-tap-lab","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmddazure%2Fvirtual-network-tap-lab/lists"}