vmnet-natd network connections question

[gilby101]

Can someone explain what my vmnet-natd is doing? This is my scenario:

1. My VMs all use bridged networking.

2. I use Little Snitch as a firewall for outgoing connections on my Mac. The current beta version includes a network utility that records connections made by (or to?) applications.

3. Little Snitch 'sees' various connections by the vmnet-natd. This is even when I have not used Fusion since last Mac reboot. See attached screen shot as an example. I have not made any conscious connections to the addresses shown.

4. These connections are only brief ones - I only ever see them in Little Snitch after the event.

5. My Mac is connected to the internet via an ADSL router so that I have a 'NAT' firewall for incoming connecitons.

Why is vmnet-netd doing anything when I am yet to run Fusion (since Mac reboot) and never use NAT Fusion networking?

Should I be worried about this behaviour?

I am trying to avoid setting up Wireshark Hence my hope for an answer.

Regards,

Gilby

[admin]

Hi Gilby,

vmnet-natd is the VMware NAT daemon that serves the private "vmnet8" VMware virtual switch by default. It is a "proxy" between the host TCP/IP stack and the virtual machines connected to vmnet8.

As a result, it opens a raw ICMP socket on the Mac OS host TCP/IP stack to receive any responses to ping requests going out from VMs connected to vmnet8.

The brief "connections" you are seeing are probably ICMP messages that the vmnet-natd daemon picks up, figures out that they are not in respose to any outgoing ping request, and ignores them.

They are harmless and you can safely ignore them. That is unless it is a security concern for you, in which case, we can probably figure out how to make vmnet-natd not open a ICMP raw socket until at least one VM is powered on and connected to vmnet8.

[gilby101]

Hi Bhaveshdavda,

Thank you, that does explain what is going on. Since my original post I have worked out that the remote IP addresses are the same as addresses being used by Skype (a very chatty bit of software ). With that and your response. I now suspect that Skype is sending the ICMP requests and the responses are being received by the NAT daemon (as well as Skype). I shall stop worrying about it!!

I don't think you need to stop this behaviour of vmnet-natd. I can see that it is a required part of its function. The change I would request is the ability to turn off networking components that are not required as part of VMware preferences - there must be many people who always used bridged networking only. This would bring it in line with other VMware products - and you may have it planned anyway.

Regards,

Gilby