Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I'm running VMWare 5 and I have found that when I start up VMWare I see two connections:


However I have set up my firewall to block the first one:

00100 deny ip from to any
00200 deny log ip from to any
00300 deny log ip from any to
00400 deny ip from any to
00500 deny log ip from any to
00600 deny log ip from any to
00700 deny log ip from any to
00800 deny log ip from any to
00900 deny log ip from any to
01000 deny log ip from any to
01100 deny ip from any to
01200 deny log ip from any to
01300 deny log ip from any to
65535 allow ip from any to any

Am I missing something? How can VMWare establish a connection to or ( and netstat tell me that it is "ESTABLISHED" when my ipfw firewall settings block that specific address from being reached? Or are my setting erroneous?

Thanks for any help.

share|improve this question

3 Answers 3

If netstats says it is established I'm inclined to believe that it is correct. I would suspect that your firewall setup is at fault.

share|improve this answer

Well, first off, what is a VMWare 5? I'll assume you don't mean VMWare ESXi 5, and are probably talking about Fusion 5, but making us guess is sort of counter-productive. Is there a VMWare Server 5 for Windows? I dunno. Maybe that's it? I'm also taking a WAG that you're on some version of OS X from the ipfw rules you're posting, but again, it would help to include things like that in your questions.

What you are likely seeing is a version check/telemetry phone home to VMWare, and a request for some sort of marketing collateral from Akamai. Were you perhaps presented with a splashy advertisement suggesting you upgrade?

As for the firewall; the service you're connecting to has more than a single ip address. Doing a single nslookup isn't really going to work there. When you send a request to any sort of large web service, you're most probably being directed to one of many load-balanced clusters, with some sort of (hopefully) experience-improving metric like latency. For any service at the scale of VMWare or Akamai, there's no connecting to "the server".

Best of luck; if you're still stumped, fill us in on a bit more detail and I'll take another swing at it.

share|improve this answer
Fusion. Sometimes I do get the ad, but the thing is that the connection to the VMware server remains open long after I've dismissed the ad popup. – Friendly Nov 16 '13 at 1:39

Perhaps your firewall is not filtering traffic on a dynamically created, virtual interface? I have seen similar behavior in OSX.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.