1

I’m doing some experiments. I’m using VMWare Workstation 16 with 4 Windows 10 Pro 20H2 virtual machines. These machines are on the same VMnet (n.1) and on the same subnet (192.168.36.0/24) and I installed Wireshark on them:

  • client1 192.168.36.1 mac: 00-0C-29-A5-05-DD
  • client2 192.168.36.2 mac: 00-0C-29-D6-79-4F
  • client3 192.168.36.3 mac: 00-0C-29-90-11-85
  • client4 192.168.36.4 mac: 00-0C-29-13-54-B1

I thought that VMnets worked as a virtual switch so a computer could see (and capture) only broadcast/multicast traffic and unicast traffic directed to it. But I noticed an unexpected behavior; it seems that the VMnets work as they were a hub or that every port is a mirroring port, since I am able to capture from a computer (i.e. client3) the unicast traffic between two others (i.e. client1 and client2). Thinkng that this beavior was just for VMnet n.1 I tryied other VMnets but I got always the same result: I can see unicast traffic between two hosts from another one.

The following image shows a Wireshark session executed on client3 and, as you can see, the program has captured a lot of unicast traffic between client1 and client2: enter image description here

My questions:

  • Do the VMnets work as switch but with some kind of port mirroring? If so, how can I disable that?
  • I made bad assumption about VMnets nature and they really work as “virtual hubs”? If so, can I configure them as switches?
4
  • Does VMWare have any mention of "promiscuous mode" in its configuration? For example, both Hyper-V and VirtualBox have this in virtual machine settings. Apr 30, 2021 at 12:07
  • Hi, from the Virtual Network Editor there is no such type of configuration about a VMnet. Apr 30, 2021 at 12:25
  • 1
    There is no UI in VMware Workstation to configure promiscuous mode, but it can be configured by manually editing the .vmx file: superuser.com/q/1139028
    – jamesdlin
    May 4, 2021 at 2:11
  • @jamesdlin Thanks! It works perfectly. I made the suggested modification to .vmx file (in my case: ethernet0.noPromisc = "TRUE") and now it is ok. May 6, 2021 at 10:05

1 Answer 1

-1

You are making a wrong assumption about the sophistication level of the VMware Ethernet adapters.

Every transmission on the VMware simple network is sent to every listener. It is the job of the listener to read only its own messages that are addressed to it.

As all your VMs are on the 192.168.36.x segment, they are all receiving all messages.

The fact that you put some on a different workgroup is only significant for Windows, not for network sniffers like Wireshark.

2
  • 1
    This hasn't been true with switched ethernets (including software bridges) for decades. Both hardware switches and software bridges perform MAC address learning as a default feature, and it's a pretty unusual situation for a host device to be receiving Ethernet frames meant for someone else's MAC address (usually when the destination is not learned yet, or the MAC table overflows, or the destination host is so quiet that its entry expires). Apr 30, 2021 at 11:28
  • @user1686: You're talking here about VMware virtual switches, which I don't know if they have undergone any big changes in those decades. Theoretical arguments are very nice, but not when they contradict empirical tests. You can see from the poster's answer to you that these are very primitive switches.
    – harrymc
    Apr 30, 2021 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .