I am using Google Cloud Packet Mirroring service. I follow all the online guide https://cloud.google.com/vpc/docs/using-packet-mirroring and everything works well.
There is just one thing that I don't understand if is it possible to change. If I record a tcpdump on the target VM I can see correctly all the traffic from my subnet, but every source Hardware MAC address is the same as Internal Load Balancer (that I must use as the Google guide say).
IS it possible to preserve the original VM MAC address of mirrored traffic? If not with Google Cloud Packet Mirroring service, there is another way to accomplish that?
More information:
This is the network schema. The client VM has IP 10.0.2.10 and the target VM server has the IP 10.0.1.3. The client VM make HTTP request to target VM.
The package mirroring service take all traffic from all VM inside the subnet 10.0.2.0/24 and 10.0.1.0/24 and push it to the internal load balancer with the ip 10.0.1.5 ( yes, it is actually on the same subnet of target VM, 10.0.1.0/24).
The internal load balancer configurated with package mirroring option, send everything to a compute instance group on the subnet 10.0.4.0/24.
I always see just two MAC address. One is from my tcpdump VM and the other one maybe it's from the load balancer. Anyway, I can't find the mac address of the client and target VM machine of mirrored traffic.