Network traffic created by VDDK

[giladb]

I use VDDK to communicate with vCenter and read contents of files.

I did some sniffing on the network traffic generated by my code.

After the initial (secured) connection with vCenter, my machine begins to communicate directly with the host. The connection with the host is clear text, and not secured.

I see two problems here

1. So far I was under the impression that I only need network connectivity with vCenter. Is network connectivity to the host required ? Is there a way to get around it ? Our experience shows that this can be a problem in customers' environments.

2. Disk data travelling over the network unsecured will make customers very uneasy. How can this be resolved ?

Thanks

[admin]

1. Connectivity to the host is required to copy the data over the network. Consider using hot-add or SAN transport if this is an issue.

2. You can use nbdssl transport to encrypt the disk data.

Thanks

Sudarsan

[giladb]

Sudarsan,

Thanks for the answer.

I've read about transports in the VDDK documentation and made some experiments and I don't think I have the right combination yet.

The only thing I can guarantee about the machine that runs my VDDK code is the fact that it has connectivity to vCenter.

I cannot guarantee

- Connectivity to the host

- What vCenter my own machine is managed by. In fact, my code might actually run from a physical machine.

As I previously mentioned, I also need the communication to be secure.

What transport should I use ?

[giladb]

The documentation for VixDiskLib_ConnectEx says about the transport mode: "If a disk is opened through this connection, VixDiskLib will start with the first entry of the list"

My code flow does not explicitly open a disk, could this be the problem ?

Should I be doing anything differently ?

Code flow

- VixDiskLib_ConnectEx

- VixMntapi_OpenDisks

- VixMntapi_GetVolumeHandles

- VixMntapi_MountVolume

[admin]

Regarding your earlier question on use of transport modes. You should be able to use SAN transport mode if you have access to VC (without access to the ESX host). You need to have access to the lun hosting the source VM's vmdk files from your backup physical machine.

[giladb]

Hi,

I guess I need to clarify my previous response.

I tried different combinations of transport according to Sudarsan's recommendation. The behavior did change regardless of the combination; network traffic was always directed to the host and always in the clear.

You can see my code flow above.

Am I doing something wrong ?

On another matter, your response mentions my "backup physical machine". I am not sure what you mean by that. I am not building a backup solution, if that's what you were implying.

Our product does all its VMware actions via vCenter, and therefore our requirements from customers so far have only been network connectivity with vCenter. I would like to maintain that minimal requirement. How can I implement a solution using VDDK while requiring from customers network connectivity to vCenter only ?