VMWare Switch Is a Hub

While preparing materials for my new class TCP/IP Weapons School I needed to test how the virtual switch in VMware Server behaves. I started three VMs. All had lnc0 interfaces bridged to the host's physical NIC. Two VMs had IPs 192.168.2.51 and 192.168.2.52 assigned. The third VM had no IP assigned. When 192.168.2.51 pinged 192.168.2.52, the third VM was able to see the ICMP traffic. This means the virtual switch in VMware Server appears to behave like a hub. This makes monitoring traffic easier.

Comments

Chris Buechler said…
This is true in VMware Server, GSX, and Workstation, but not in ESX. By default, no machines in ESX can enter promiscuous mode.

This post on the VMTN forums is the best description and howto I've seen on promiscuous mode and ESX.
http://www.vmware.com/community/message.jspa?messageID=371562
mrchase said…
OKay in the two products that were mentioned VMWARE acts like a SWUB. An instance on /dev/vmnet1 will not be able to sniff traffic from an instance on /dev/vmnet2

Popular posts from this blog

Zeek in Action Videos

New Book! The Best of TaoSecurity Blog, Volume 4

MITRE ATT&CK Tactics Are Not Tactics