A method for on demand packet traffic monitoring, comprising: at an external controller coupled to a network: receiving packet flow summary data from a plurality of virtual test access ports, TAPs, operating within virtualization layers on host hardware systems coupled to the network, the packet flow summary data being associated with monitored packet flows communicated to and from virtual machine, VM, platforms (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428) operating within the virtualization layers; monitoring the packet flow summary data to determine occurrence of a first trigger event associated with a first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); generating watch filter (124; 432) rules in response to an occurrence of the first trigger event; and transmitting the watch filter (124; 432) rules through the network to a first virtual TAP, associated with the first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); and at the first virtual TAP: receiving the watch filter (124; 432) rules from the external controller; using the watch filter (124; 432) rules to configure a watch filter (124; 432) associated with one or more packet flows being communicated with respect to applications running within the first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); generating watch packet data associated with the applications using the watch filter (124; 432), the watch packet data including detailed packet traffic statistics for the applications; and periodically transmitting the watch packet data to the external controller through the network. at an external controller coupled to a network: receiving packet flow summary data from a plurality of virtual test access ports, TAPs, operating within virtualization layers on host hardware systems coupled to the network, the packet flow summary data being associated with monitored packet flows communicated to and from virtual machine, VM, platforms (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428) operating within the virtualization layers; monitoring the packet flow summary data to determine occurrence of a first trigger event associated with a first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); generating watch filter (124; 432) rules in response to an occurrence of the first trigger event; and transmitting the watch filter (124; 432) rules through the network to a first virtual TAP, associated with the first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); and receiving packet flow summary data from a plurality of virtual test access ports, TAPs, operating within virtualization layers on host hardware systems coupled to the network, the packet flow summary data being associated with monitored packet flows communicated to and from virtual machine, VM, platforms (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428) operating within the virtualization layers; monitoring the packet flow summary data to determine occurrence of a first trigger event associated with a first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); generating watch filter (124; 432) rules in response to an occurrence of the first trigger event; and transmitting the watch filter (124; 432) rules through the network to a first virtual TAP, associated with the first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); and at the first virtual TAP: receiving the watch filter (124; 432) rules from the external controller; using the watch filter (124; 432) rules to configure a watch filter (124; 432) associated with one or more packet flows being communicated with respect to applications running within the first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); generating watch packet data associated with the applications using the watch filter (124; 432), the watch packet data including detailed packet traffic statistics for the applications; and periodically transmitting the watch packet data to the external controller through the network. receiving the watch filter (124; 432) rules from the external controller; using the watch filter (124; 432) rules to configure a watch filter (124; 432) associated with one or more packet flows being communicated with respect to applications running within the first VM platform (104, 106...108; 404, 406...408; 414, 416...418; 424, 426...428); generating watch packet data associated with the applications using the watch filter (124; 432), the watch packet data including detailed packet traffic statistics for the applications; and periodically transmitting the watch packet data to the external controller through the network.