# Vswitch Standard Info

## Overview

**Evidence:** Vswitch Standard Info\
**Description:** ESXi Vswitch Standard Info\
**Category:** Network\
**Platform:** esxi\
**Short Name:** vswitchstdinfo\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

Virtual Standard Switches (vSwitch) provide network connectivity for virtual machines and VMkernel interfaces. vSwitch configuration defines network segmentation, security policies, and traffic shaping, making it critical for understanding network topology and detecting unauthorized network modifications.

## Data Collected

This collector gathers structured data about vswitch standard info.

### Vswitch Standard Info Data

| Field              | Description        | Example       |
| ------------------ | ------------------ | ------------- |
| `Name`             | Name               | Example value |
| `Class`            | Class              | Example value |
| `NumPorts`         | Num Ports          | 123           |
| `UsedPorts`        | Used Ports         | 123           |
| `ConfiguredPorts`  | Configured Ports   | 123           |
| `MTU`              | MTU                | 123           |
| `CDPStatus`        | CDP Status         | Example value |
| `BeaconEnabled`    | Beacon Enabled     | Example value |
| `BeaconInterval`   | Beacon Interval    | 123           |
| `BeaconThreshold`  | Beacon Threshold   | 123           |
| `BeaconRequiredBy` | Beacon Required By | Example value |
| `Uplinks`          | Uplinks            | Example value |
| `PortGroups`       | Port Groups        | Example value |

## Collection Method

This collector parses standard vSwitch configuration data, extracting switch names, number of ports, configured port groups, uplink associations, NIC teaming policies, security settings, traffic shaping parameters, and VLAN configurations.

## Forensic Value

vSwitch configuration analysis reveals network segmentation policies, detects promiscuous mode enabling that could indicate packet sniffing, identifies unauthorized VLAN access, and exposes network policy violations that may facilitate lateral movement or data exfiltration.