Detect if remote host is a virtual machine?

[steffi2]

Is it possible for software to detect whether a remote host is vmware virtual machine?

[WoodyZ]

I do not know of a specific programming API that is designed to return a value to distinguish between physical vs virtual however one can certainly check for the presence of specific virtual hardware and or drivers associated with it to make the determination and act accordingly.

This has been covered more then a few times throughout various communities here so a search should yield additional information.

[a_p_]

If you are running a Windows environment, one option is to use WMI.

I just created a small vbs for you, using Scriptomatic 2.0

On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

arrComputers = Array(".")
For Each strComputer In arrComputers
   WScript.Echo
   WScript.Echo "=========================================="
   WScript.Echo "Computer: " & strComputer
   WScript.Echo "=========================================="

   Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
   Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem", "WQL", _
                                          wbemFlagReturnImmediately + wbemFlagForwardOnly)

   For Each objItem In colItems
      WScript.Echo "Manufacturer: " & objItem.Manufacturer
      WScript.Echo "Model: " & objItem.Model
      WScript.Echo "Name: " & objItem.Name
      WScript.Echo
   Next
Next

André

[a_p_]

The output for on an XP client on VMware Workstation looks like this:

==========================================

Computer: .

==========================================

Manufacturer: VMware, Inc.

Model: VMware Virtual Platform

Name: MyVirtualPC-Name

Note: The computername "." refers to the local computer.

André

[a_p_]

Uups, just realized we are in the "VMware Fusion (for Mac)" forum.

If the above does not apply for you, just ignore it

André

[steffi2]

Can I set the mac address for a different vendor other than vmware

Also if I connect to a different network from vmware what mac address will the remote server see?

[WoodyZ]

Can I set the mac address for a different vendor other than vmware

With the Virtual Machine shutdown, not suspended, in VMware Fusion go to the Network settings for the target Virtual Machine and then click Advanced options and in the MAC Address: text box type the MAC Address in the form of xx:xx:xx... etc. Now click on the Show All button and then click the Apply button.

Also if I connect to a different network from vmware what mac address will the remote server see?

If you use Bridged then next device you connect to sees the MAC Address you assigned.

Message was edited by: WoodyZ - Rephrased original reply.

[steffi2]

What about is using nat networking and the connection is wifi to the Internet. What will the remote server see?

[steffi2]

So if you have a Mac and it's running Fusion and you using a VM to connect to a remote server where you are using NAT networking b/w the VM and the host. And your Mac is on the internet. What mac address does a remote server see for this machine?

[rcardona2k]

So if you have a Mac and it's running Fusion and you using a VM to connect to a remote server where you are using NAT networking b/w the VM and the host. And your Mac is on the internet. What mac address does a remote server see for this machine?

MAC addresses aren't normally transmitted over the internet, IP addresses are as there's no field for MAC address in IP headers. Only your local subnet machines and your gateway track MAC addresses in their ARP tables. On your local subnet, those machines have your host's MAC address in their ARP table (if on Ethernet or 802.x).

[steffi2]

What is Nessus doing when it sees that the Mac Address of a remote machine is a VMWare Virtual Machine? It specifically has a policy to check for this.

What is the definition of "remote" ... Remote is then only on the same physical LAN?

[rcardona2k]

What is Nessus doing when it sees that the Mac Address of a remote machine is a VMWare Virtual Machine? It specifically has a policy to check for this.

I don't know about Nessus. Are you installing a client in your VM that connects to a scanner? Or are black-box testing your VM? Since a VM in NAT mode is borrowing host networking a scanner like nmap or nessus should be seeing an OS X target. You could also be port-forwarding services on host ports to your guest VM, so a port scanner should be able to detect those.

What is the definition of "remote" ... Remote is then only on the same physical LAN?

As far as MAC address tracking goes yes, only on the physical LAN. MAC addresses are lost beyond your IP gateway. Any remote server will have their nearest IP gateway as the source MAC address for a TCP/IP connection as that is where those packets are coming from.

The exception is, if you have a client/agent interrogating your VM and revealing MAC addresses in the data stream as part of a report.