1

Recently, using VMWare Player, I have configured a Linux virtual machine on a Windows host. I set the network adapter to be a bridged network with the Replicate option checked. The IP address was on the physical network but using the command arp -a will result differently between the host and the virtual machine--the host can spot other hosts on the Wi-Fi network while the VM cannot.

Knowing that the host is like a switch that forwards the network information to the VM, I think the VM is able to access the real network, but I cannot understand why it cannot. I want to know how exactly this bridged network works and if I can grab the actual network inside the virtual machine.

--- edit ---

The funny thing is that I see some but not all results through arp-scan -l

Here is the output:

  1. arp -a result on Windows host
  2. arp result on Linux VM
  3. arp-scan -l on VM

  'arp -a' result on Windows host   'arp' result on Linux VM   'arp-scan -l' on VM

Improve this question
4
  • I think an arp -n; ip adds ls; ip route ls output for both the host and the guest were useful to get a good answer. Commented Nov 26, 2013 at 23:19
  • Please provide output of what you're seeing. Commented Nov 26, 2013 at 23:39
  • @slm I have added the output Commented Nov 27, 2013 at 1:55
  • @MaXX 'arp -n' results in nothing; I don't get the second command; 'ip route' does not do much either. Commented Nov 27, 2013 at 1:57

3 Answers 3

Reset to default
1

I'm not entirely sure your assumption is correct. I regularly use bridged network devices and its been my experience that the network traffic for one of the VMs is somewhat isolated. I use KVM but the bridging technology I use are what are offered by the Linux host, so I would imagine they're maybe not identical but similar.

Also your use of arp confuses me. That command just shows what systems have recently been contacted by a system, and they're MAC address to IP address mappings are maintained in the systems ARP cache. The command arp is displaying the contents of this cache.

Example

I have a VM host + 1 guest.

host

$ arp -a
hostX (192.168.1.226) at XX:XX:XX:XX:XX:XX [ether] on br0
hostY (192.168.1.7) at XX:XX:XX:XX:XX:XX [ether] on br0
hostZ (192.168.1.5) at XX:XX:XX:XX:XX:XX [ether] on br0
hostA (192.168.1.1) at XX:XX:XX:XX:XX:XX [ether] on br0

guest

$ arp -a
hostA (192.168.1.1) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostY (192.168.1.7) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostB (192.168.1.100) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostC (192.168.1.8) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostX (192.168.1.226) at XX:XX:XX:XX:XX:XX [ether] on eth0

Bridges are Layer 2 devices, so I wouldn't expect to see any evidence of arp data on the VM host, from the VM guest.

excerpt - 9.2.5. Network Bridge - Redhat docs

A network bridge is a Link Layer device which forwards traffic between networks based on MAC addresses and is therefore also referred to as a Layer 2 device. It makes forwarding decisions based on tables of MAC addresses which it builds by learning what hosts are connected to each network. A software bridge can be used within a Linux host in order to emulate a hardware bridge, for example in virtualization applications for sharing a NIC with one or more virtual NICs.

Debugging this further?

I would employee the networking analysis tool tcpdump on both the guest and host VMs. This will likely show you where the bottleneck is.

$ sudo tcpdump -i eth0

Change the argument to -i for which ever network interface you'd like to monitor.

Improve this answer
2
  • +1 Perhaps nmap would provide more data on which hosts are really visible from within the VM. Commented Nov 27, 2013 at 7:51
  • @JosephR. - either that or tcpdump. Commented Nov 27, 2013 at 7:57
0

The arp(8) command shows the contents of the translation tables used by the Address Resolution Protocol by the OS; the table mostly consists of the cached replies to the local arp who-has requests.

If you have a virtual machine, with bridged networking, but which is not actively communicating with any of the hosts on the local network, then its arp table is likely to be pretty small.

Likewise, if you have several local networks on the host, but you only bridge one of such networks to the VM, then you're not actually bridged to the other networks, now are you?

It may sound like you've bridged the GigE, without bridging the WiFi.

Or, perhaps, you've bridged the WiFi, but the access point doesn't like your new MAC address.

Improve this answer
1
  • I tried configuring the adapter to be used but it didn't work out. I don't know how to actively communicate with other hosts through a virtual machine either. But, yeah, probably it's because of my MAC address. Commented Nov 27, 2013 at 1:59
0

Based on the pictures you've attacked — arp -n returning absolutely nothing on your Linux VM — it sounds like you've simply forgot to configure the IP address within Linux, hence you're getting no ARP entries whatsoever.

Did you configure a static allocation within Linux manually, or are you running a dhclient within your Linux VM? You didn't provide even any ifconfig output to be able to discern the problem further.

You might also have to consider that maybe your access point may not like you to be extending its network.

Improve this answer
1
  • my machine replicates the physical network and the IP address is 192.168.1.13, which is recognized by the host. Commented Nov 27, 2013 at 3:24

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.