3

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine.

In my lab I have lots of workstations, each running a VirtualBox with network adapter bridged to the host adapter (eth0 or wlan0). Each virtual machine has a malformed MAC and of course different IP addr (set statically or through DHCP).

When I analyze packages with tcpdump (or wireshark) I can't see any common points between hosts and particular VMs. But maybe I'm wrong?

Is there a way to find a host-machine based a traffic generated by VMs doing for example nmap scanning of my lab network?

Improve this question
3
  • What operating system(s) are you running on your host / guest? These are important, as there are differences in the network stack capabilities - for example, Windows won't let you monitor loopback interfaces.
    – Polynomial
    Commented Sep 23, 2013 at 13:52
  • Host is on Ubuntu and guests may be different, they may run Windows or some Linux
    – SP5RFD
    Commented Sep 24, 2013 at 6:17
  • If your question is whether nmap can properly identify the OS of a guest system, have you tried scanning?
    – schroeder ♦
    Commented Oct 4, 2013 at 15:51

1 Answer 1

Reset to default
2

IMHO, the main point that can expose the identity of host machine is the way you configure the network between the host and guest.

Network Setting in VMware

For example, in NAT setting, it would be possible for other machines in Host machine's network to identify that you are in NAT network and they can easily guess the NAT address for the host machine and try footprinting. But in bridged network, it won't be possible as it presents guest as another host in the network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .