What causes the message "A virtual machine is attempting to monitor all network traffic message" to display?

[jbreitma]

I have been using VMware Fusion 7.X for a long time and just noticed this message popup a few times this week.

Many people recommend the solution below, but I want to understand why the message is being triggered and what that functionality is.

  touch "/Library/Preferences/VMware Fusion/promiscAuthorized"

Please explain.

[wila]

Hi,

This only happens when a network adapter wants to use promiscuous mode.

This means that the network adapter will not only being able to monitor the network traffic that is meant for that adapter, but to also sniff on all of the network traffic that simply passes by. As being able to look at network traffic that is not directly targeted at that network adapter is a special case, you need to have administrative rights.

Hence the popup.

There are a few other use cases however.

For example, if you try to run a virtualized vSphere instance then that nested VM has network adapters that need to be able to assign network addresses in any range, this also requires the same "promiscuous" mode.

For more info see:

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=10029...

and

http://www.virtuallyghetto.com/2013/11/why-is-promiscuous-mode-forged.html

--

Wil

[jbreitma]

Thank you for your response.

Is there a way to disable this functionality?

I do not want to allow this access and also do not want the user to be prompted.

[wila]

Hi,

Not as far as I am aware.

There's a checkbox under menu Fusion -> Preferences -> Network

"Require authentication to enable promiscuous mode"

to disable the popup, but not to disable the functionality.

--

Wil

[Mikero]

I would probably be more concerned with what application is trying to do that rather than disabling it on the host side.

Something in your VM wants promiscuous mode, Fusion's just responding to the request asking your permission, like it should.

[jbreitma]

Mikero - Exactly.  Is there a way to determine what application made the request?  It would be great if there was a VMware log to look at that would say who / what made the request.

[Mikero]

Fusion's virtual hardware won't log the requester, only that it was requested and presented you the dialogue, you'll need to check your guest logs.

To give a comparison, a physical NIC doesn't log anything, it just does what it's told.

How you figure it out tho could go from something simple like:

- use fusion until you get the message

- Examine all running processes in Windows, google anything you don't know about

To something as involved as the following:

- let the operation succeed ('allow' the promiscuous mode to enable)

- Use vmnet-sniffer to capture all the packet data from the host on the vmnet you're using

- analyze the pcap data with wireshark to understand what it's actually doing.

The latter is an exercise in really low level packet analysis and is not for the faint of heart, but if you know what you're doing (or are willing to do the research) it will tell you what's going on with no holds barred.

[IlDavo]

I, too have used VMware Fusion for several years.

I, too, have only just begun experiencing pop-ups in my MacOS host environment (macOS Sierra 10.12.5) coming from VMware Fusion (in my case: version 8.5.7) reporting that each of two MS Windows 10 Pro (version 1607 build 14393.1198) guest VM's "is attempting to monitor all network traffic, which requires administrator access."

I'm not aware of having installed any software in either guest VM that is designed to sniff network traffic, and I'd really like to know what OS services or installed applications might be trying to place my virtual network adapter in "promiscuous mode."

I really appreciate @wila 's background information and @Mikero 's diagnosis/research suggestions; however, I'd be truly grateful if anyone who has addressed this issue (@jbreitma and I can't be the only ones?) might share news of any Windows OS services or applications they found caused their Windows guest VM's to generate this VMware popup?

Thank you!

[dariusd]

I don't have any specific answers.  Perhaps there might be useful information in the Windows Event Viewer (eventvwr.exe) at the time that the dialog box appears... the Windows kernel may want to log that an application has requested such privileged access to the network device.  Otherwise, I'd try something like Sysmon, Process Explorer or Handle to identify the culprit.

If you have no network-monitoring application installed in the Windows VM, it could be that some Windows system service is attempting to detect network characteristics or optimize network performance... it would be highly unusual, though.  Another possibility (not that I wish to create panic) is that it might be malware which is attempting to capture network traffic, so make sure that your Windows antivirus/antimalware software is completely up-to-date and have it run a scan.

Cheers,

--

Darius

[msschmitt]

I had a Windows 7 virtual machine that started popping this up after upgrading to Windows 10. I couldn't figure out why.

So last week I built a new Windows 10 virtual machine completely from scratch.  It started popping up the same message before installing any applications. So, whatever is causing this is is in Windows 10 itself.

One strange thing is that it didn't do it immediately after installing. It started sometime after I allowed Windows to apply updates and started configuring Windows.

For example, one setting was that it defaulted to classifying the local network as Public. After installation I changed it to Private.  Does that mean I've given Windows free license to snoop on the network?

[jamescpa]

No such link on my VMWare.

[wila]

Hi,

---

@jamescpa wrote:

No such link on my VMWare.

---

What link are you looking for?
I'm not understanding what you are referring to, can you please enlighten us so we can help?

--
Wil

[DrBill7100]

So if I select "Cancel", promiscuous mode is denied?