RE: [ISSForum] scanning vmware stations

[Duncanson, Robert]

Title: scanning vmware stations

Augusto,

 

It depends on what you're scanning for, and whether you're trying to find VMWare'd boxes, or trying to hide them.

 

Typically you'd identify the host by a combination of banners, IP stack signatures and available services - software you happen to run on the host doesn't change that. In your case the linux host is still a linux host, just as running IE instead of explorer on a windows box won't change it from a windows box (unfortunately).

 

On the other hand, your VMWare guest could be confgured with bridged networking, sharing the physical network interface with the host. Physical/bridge is the key, because scanning typically occurs at layer 3, certainly so with IP, and so the distinction between guest and host (which have different IP's, so you see two distinct hosts) is total. Basically,it's a red herring, you still have two IP hosts, they just happen to share the same hardware. (They only interact using IP anyway, so no funny stuff  is going on)

 

The only clue you may is if your MAC address gives the game away - but if it's the same there are any number of reasons to explain that, like somebody proxy arp:ing for another box. Could be a router doing it.

 

 

/Robert

 

 

 

 -----Original Message-----
From: Bruschi, Augusto Mr., (Systems Administration) [mailto:[EMAIL PROTECTED]]
Sent: 15 November 2002 08:09
To: [EMAIL PROTECTED]
Subject: [ISSForum] scanning vmware stations

Hello all,

question: if I scan a station that has Linux as host operating system and Windows 2000 Pro as guest operating system using VMWare software what will I see? A Linux based station or a Windows based station?

Thank you and good work to all.

Augusto Bruschi
System Administrator Grafenwoehr

IMO/IASO/SA
U.S.Army
100 ASG MWR/MIS
DSN: 475 6401
Commercial: +499641-83-6401
[EMAIL PROTECTED]