I’m doing some experiments. I’m using VMWare Workstation 16 with 4 Windows 10 Pro 20H2 virtual machines. These machines are on the same VMnet (n.1) and on the same subnet (192.168.36.0/24) and I installed Wireshark on them:
- client1 192.168.36.1 mac: 00-0C-29-A5-05-DD
- client2 192.168.36.2 mac: 00-0C-29-D6-79-4F
- client3 192.168.36.3 mac: 00-0C-29-90-11-85
- client4 192.168.36.4 mac: 00-0C-29-13-54-B1
I thought that VMnets worked as a virtual switch so a computer could see (and capture) only broadcast/multicast traffic and unicast traffic directed to it. But I noticed an unexpected behavior; it seems that the VMnets work as they were a hub or that every port is a mirroring port, since I am able to capture from a computer (i.e. client3) the unicast traffic between two others (i.e. client1 and client2). Thinkng that this beavior was just for VMnet n.1 I tryied other VMnets but I got always the same result: I can see unicast traffic between two hosts from another one.
The following image shows a Wireshark session executed on client3 and, as you can see, the program has captured a lot of unicast traffic between client1 and client2:
My questions:
- Do the VMnets work as switch but with some kind of port mirroring? If so, how can I disable that?
- I made bad assumption about VMnets nature and they really work as “virtual hubs”? If so, can I configure them as switches?
.vmx
file: superuser.com/q/1139028