Hi,
I know this topic seems to be done to death, and I have read through the various topics covering it but I still have a problem I do not seem to be able to resolve. It always seems that there is an argument over where the problem is occurring but rarely do I see a lot of information about how the MAC addresses work and I feel that maybe where my problem lies.
I have a notebook computer running Win XP Pro SP2 which has both a Wired and Wireless ethernet connection. When it is connected to my own network my network DHCP assigns it an IP address based on the relevant MAC adddress on a 192.168.1.0 network
This machine uses VMPlayer and hosts a honeynet of a couple of guest OS's. I am using a NAtted network for my 192.168.154.0 honeynet. The VMWare DHCP server allocates IP addresses to all but one of the Guests, I have a Fedora web server which I have allocated a couple of Static IP addresses outside the pool for the VMware DHCP. I use VMWare's NAT's Port Forwarding to take my port 80 traffic when the notebook is physically connected to my own network to the Guest Fedora web server
The purpose of this honeynet is so that I can do development work and testing a on a variety of client OS's, and have a development web server to test it against The NATted honeynet means I can do this development work when I am connected to my own network, not connected, or connected to a clien'ts n network. The Port Forwarding means I can connect to the development web server from other PC's on my network, and I can easily manipulate the HOSTS file to point to the real server or the development server
I am having a problem with the Guest Windows os's when their IP addresses are configured from the VMware DHCP. I get IP Address conflicts, and I repeatedly have to "repair"the (Virtual) Local Network connection, I presume this just clears the ARP cache so it works for a while. I only use one Windows guest at a time, and I have made sure the the VMX file has different MAC addresses for each virtual guest Windows machine, (probably irrelant since none of the Windows virtual machines execute concurrently)
Looking at the System Event log on the Host WinXP machine, I see that a duplicate IP error is being generated from a MAC address of 00-50-56-EE-35-C2, and according to the IEEE the 00-50-56 prefix belongs to VMWare. The auto generated Ethernet address for the Guests in the VMX file are the 00-0C-29-xx-xx-xx prefixed addresses which also belong to VMWare. There is definitely no duplicated IP addresses as the VMware DHCP and since only only DHCP client is ever running it is only allocating one IP address, well actually two, one for itself as the DHCP server (at the top of its DHCP pool.
The VMNet8 NAT virtual Ethernet connection has the MAC Address 00-50-56-C0-00-18 visible from Host. 'The other VMNet virtual ethernet adaptors are disabled, and do not appear in the hosts ipconfig /all adaptor list,
So, I dont seem to have duplicate IP addresses or duplicate MAC addresses... and I can't find any reference to MAC Address reports in the in the System Event log error message.
Is there a hidden MAC address allocated for the DHCP Server that might itself be causeing the problem? And, why does the DHCP server have an IP address at the top of the DHCP pool range, rather than an address outside it... Why wouldn't it simply use the gateway address??
Thanks
Brian
