3

I'm running VMware 5 and I have found that when I start up VMware I see two connections:

TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED)
TCP 10.100.100.161:55556->a184-85-99-51.deploy.static.akamaitechnologies.com:https (ESTABLISHED)

However I have set up my firewall to block the first one:

00100 deny ip from 17.172.224.0/20 to any
00200 deny log ip from 82.128.0.0/16 to any
00300 deny log ip from any to 64.236.0.0/16
00400 deny ip from any to 208.91.0.0/22
00500 deny log ip from any to 173.194.0.0/16
00600 deny log ip from any to 64.4.61.0/24
00700 deny log ip from any to 207.246.128.0/17
00800 deny log ip from any to 216.127.0.0/18
00900 deny log ip from any to 23.0.0.0/8
01000 deny log ip from any to 184.84.0.0/14
01100 deny ip from any to 184.85.99.51
01200 deny log ip from any to 93.184.0.0/16
01300 deny log ip from any to 239.200.3.0/24
65535 allow ip from any to any

Am I missing something? How can VMware establish a connection to 184.85.99.51 or vmware.com (208.91.0.132) and netstat tell me that it is "ESTABLISHED" when my ipfw firewall settings block that specific address from being reached? Or are my setting erroneous?

Improve this question

3 Answers 3

Reset to default
3

If netstats says it is established I'm inclined to believe that it is correct. I would suspect that your firewall setup is at fault.

Improve this answer
1

Well, first off, what is a VMWare 5? I'll assume you don't mean VMWare ESXi 5, and are probably talking about Fusion 5, but making us guess is sort of counter-productive. Is there a VMWare Server 5 for Windows? I dunno. Maybe that's it? I'm also taking a WAG that you're on some version of OS X from the ipfw rules you're posting, but again, it would help to include things like that in your questions.

What you are likely seeing is a version check/telemetry phone home to VMWare, and a request for some sort of marketing collateral from Akamai. Were you perhaps presented with a splashy advertisement suggesting you upgrade?

As for the firewall; the service you're connecting to has more than a single ip address. Doing a single nslookup isn't really going to work there. When you send a request to any sort of large web service, you're most probably being directed to one of many load-balanced clusters, with some sort of (hopefully) experience-improving metric like latency. For any service at the scale of VMWare or Akamai, there's no connecting to "the server".

Best of luck; if you're still stumped, fill us in on a bit more detail and I'll take another swing at it.

Improve this answer
1
  • Fusion. Sometimes I do get the ad, but the thing is that the connection to the VMware server remains open long after I've dismissed the ad popup.
    – Friendly
    Commented Nov 16, 2013 at 1:39
0

Perhaps your firewall is not filtering traffic on a dynamically created, virtual interface? I have seen similar behavior in OSX.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .