VMNet1 Traffic without any running VMs

[pablo111bronco]

Anyone noticed that they have network traffic over VM Ethernet interfaces without any VMs running?  I've seen some odd issues with my workstation and Wireshark shows traffic originating from the VNnet interfaces.  I confirmed no VMs are loaded or running.  I disabled the interfaces and, obviously, the traffic stopped.

I use VM Workstation 15.5.

[tzat]

I see bootstrap protocol (BOOTP) outgoing and responding from the DHCP addresses associated with the adapters, triffic is minimal, 80 kb over the last 24 hours, nothing going on other than that, and probably nothing to worry about at all. Try running glasswire and see what it shows you, let it run for a while, or just after a reboot, if it is the same as what I am seeing, then its nothing to worry about.

[dariusd]

The virtual network interfaces on the host (vmnet1, vmnet8) are fully-fledged Ethernet adapters as far as the host is concerned.  They will be assigned real IP addresses on the host, and at that point they will operate just like any other Ethernet interface.

This means that any services running on the host which wish to announce their presence on the network may well also start announcing on the vmnet1/vmnet8 interfaces.  Of particular note here is any service running on the host which uses Zeroconf/Rendezvous/Avahi... Most likely such services will listen on the virtual network interfaces unless they are specifically configured not to do so, and will also broadcast their availability on those virtual networks.

If you have any concerns about traffic on the virtual network, please do feel free to post a capture file and we'll work on understanding/explaining (or fixing!) it.

Thanks,

--

Darius