More info. I ran wireshark on the host specifically looking for ARP requests. I see an ARP request for the gateway, which is answered (two request/reply pairs for some reason) and an ARP request ...
See more...
More info. I ran wireshark on the host specifically looking for ARP requests. I see an ARP request for the gateway, which is answered (two request/reply pairs for some reason) and an ARP request for the assigned address with no reply, as expected, but followed by the DHCPDECLINE. Then I ran the same on the guest VM with similar but subtly different results, and I'm not sure if the differences are as expected or are a problem. Comments and observations: * I have disabled everything I can in the adapter properties on Win7, including IPv6 and Microsoft networking. The only checkbox enabled is IPv4. * I have no idea what the IGMP traffic is setting up or if it could be a problem. It seems unlikely. * I haven't expanded the DHCP Offer/Ack, but I've walked through several other transactions, and it appears correct. In this case it was assigned 192.168.34.131. * There are two requests by the VMware ethernet address (Vmware_8e:2c:04) for the address of the router, 192.168.34.1. Both get a reply from the Linksys router (Cisco-Li_f6:46:8e) * There is an ARP request by the VMware ethernet address for 192.168.34.131. This should have no reply, because that would mean the address already exists on the LAN. * There is a subsequent ARP request by the Wifi adapter's address (IntelCor_85:1b:a4) for 192.168.34.131. * There is no reply to either of those ARP requests (as expected) * Immediately after these requests is the DHCPDECLINE. Differences on the host side: I'm not going to post a screenshot because they would be for different transactions and misleading, but: * All ARP requests originate from the Intel address * The Linksys router replies to the Intel address (which becomes the VMware device in the guest) * There is only one request for 192.138.34.131 on the host side, originating from the Intel address, still with no reply, of course. So a couple of options present themselves: * The ARP who-has issued by the guest is getting an invisible reply; something in the driver layer recognizes the address as assigned to the wifi adapter and is answering without the traffic being visible to Wireshark. This seems unlikely, but it could be a bug in virtualization code. * The call to send the who-has is not behaving precisely in the virtual driver as it would be for the host talking directly to the card, and Windows is finding an error. (On reflection, both of these are bogus. The adapter, virtualized or not, is on the other side of Wireshark's monitoring from the Windows IP stack. What's causing the failure has to be visible to Wireshark.) * The ARP who-has issued by the Intel device for its own address is being seen as a separate device claiming ownership of that address. What makes me suspect this is that the ARP requests for the router's address are not visible to the guest. It doesn't see the requests, only the translated replies. However the ARP request from IntelCor_85:1b:a4 for 192.168.34.131 is visible to Wireshark. Perhaps the Windows ethernet layer sees that request, considers that there is another device requesting the same IP address and bombs out. I've googled several references to a related problem in Win7/Vista. This final ARP who-has is apparently new behaviour. In one case the router was replying to that who-has, and it wasn't possible to get an IP address. I haven't found precisely what I'm seeing here, though, which is a decline after no ARP reply or a different device's ARP request. I've also found references to "disabling Windows address conflict detection," but nowhere that would tell me how, if it's even possible. All I could find was a router setting, not client-side.