Hi

• a production NIC (attached to a normal vSwitch)
• a dedicated capture-only NIC, attached to a separate virtual switch that receives SPAN/mirror traffic from a physical switch (Allied Telesis x510 stack)

Network Packet Sensor is installed successfully in DPI Engine mode and bound to that second (capture) NIC. The sensor shows "Up" in the UI, and the DPI Add-On license correctly shows 1/1 — but the DPI reports/widgets only show traffic the Probe VM itself generates (DHCP, LLMNR, mDNS, etc.), not the actual mirrored WAN traffic the switch is sending.

What I've already checked:

• The mirror session on the switch is active; packet counters on both source and destination ports are actively incrementing
• Cable/port mapping confirmed via the switch's MAC address table
• "Enable MAC address spoofing" is turned on for the capture vNIC
• Link status is Up (1 Gbps) on both the Hyper-V host and inside the guest VM
• A direct Wireshark capture on the capture NIC inside the VM shows 0 incoming mirrored packets — only the VM's own outbound broadcast traffic
• Tried Hyper-V's built-in "Port Mirroring" feature (Destination mode) on the vNIC — no effect (likely because that's meant for VM-to-VM mirroring within the same vSwitch, not external SPAN traffic)

My working theory is that the Hyper-V External Virtual Switch is dropping incoming frames whose destination MAC address doesn't belong to the guest vNIC — which would explain why mirrored traffic (which retains the original source/destination MACs from the network) never reaches the guest OS, even though the physical host NIC receives it fine.

Questions for the community/support:

1. Is Discrete Device Assignment (DDA) / physical NIC passthrough to the VM the only reliable way to run the DPI Engine on a Hyper-V VM fed by external SPAN/mirror traffic?
2. Has anyone run the NPS DPI Engine on Hyper-V with mirrored traffic successfully — is there a supported configuration that doesn't require full NIC passthrough?
3. Is there official documentation/a deployment guide for this specific scenario (DPI Engine on a virtualized, SPAN-fed Probe)?