Hello
I have installed a Debian VM in Workstation player, created 2 copies of it(all NAT network adapter). If I run tshark on any of them, I can see the network traffic the other VMs generate. How can I explain why? Is it completely normal and not even related to VMware settings?
I know Tshark runs in promiscous mode, but it requires that all the trafic is indeed send to all machine, right? As far as I know VMware uses a virtual switch which has promiscous mode disabled by default, so I'm a bit confused.
Edit: I just found a question from 2016 where they said promiscous mode is enabled on windows host by default. I guess that is still valid, so that explains it.
https://communities.vmware.com/t5/VMware-Workstation-Pro/Promiscuous-Mode-by-Default/td-p/2717392
