I’ve been writing about deploying VMware Server Beta on Debian. Today I tried my Sguil VM and found I could not sniff all traffic on lnc1. I could only see broadcast traffic (ARP, DHCP, etc.) That indicated lnc 1 was not seeing the physical interface in promiscuous mode.Luckily I found this GSX document which said:GSX Server does not allow the virtual Ethernet adapter to go into promiscuity mode unless the user running GSX Server has permission to make that setting.”]
Source: https://taosecurity.blogspot.com/2006/03/promiscuous-mode-on-linux-vmware.html