Frequently asked questions

How to detect a Virtual Machine by its MAC address?

Our MAC Address API outputs a field called macAddressDetails.virtualMachine. If it detects that a Virtual Machine is using this MAC address, it outputs its vendor name (e.g. ”VMWare”). Otherwise, it outputs “Not detected”.

To detect the Virtual Machines, we build our VM Knowledge Base, which stores information about known relations between MAC addresses and Virtual Machines, and patterns, based on which the Virtual Machines assign MAC addresses to the virtual network interfaces.

This information comes from the two sources:

We constantly scan the Internet for such information. It’s systemized, stored and verified.
Our research team installed the Virtual Machines and performed experiments, trying to identify patterns on how their network interfaces receive MAC addresses.

Virtual machine detection simplified schema

Virtual Machine’s MAC ranges

Detection rules which don't have their dedicated page yet

Virtual Machine Name	OUI or range	References

Red Hat Xen, XenSource, Novell Xen	00:16:3E:00:00:00 to 00:16:3E:FF:FF:FF	https://wiki.xenproject.org/wiki/Xen_Networking https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms
Microsoft SCVMM (System Center Virtual Machine Manager)	00:1D:D8:B7:1C:00 to 00:1D:D8:F4:1F:FF	http://techgenix.com/mac-address-pool-duplication-hyper-v/ https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807 https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/
Microsoft Virtual PC / Virtual Server	00:03:FF:00:00:00 to 00:03:FF:FF:FF:FF	https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms/ https://blogs.technet.microsoft.com/medv/2011/01/24/how-to-manage-vm-mac-addresses-with-the-globalimagedata-xml-file-in-med-v-v1/
SWsoft	00:18:51:00:00:00 to 00:18:51:FF:FF:FF	https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx
bhyve by FreebsdF	58:9C:FC:00:00:00 to 58:9C:FC:FF:FF:FF	https://macaddress.io/statistics/company/17619
Nutanix AHV	50:6B:8D:00:00:00 to 50:6B:8D:FF:FF:FF	https://macaddress.io/statistics/company/17388
KVM (proxmox)	54:52:00:00:00:00 to 54:52:FF:FF:FF:FF	https://www.centos.org/forums/viewtopic.php?t=26739
Hetzner vServer (based on KVM and libvirt)	96:00:00:00:00:00 to 96:00:FF:FF:FF:FF	Self tested

We are warmly welcoming your thoughts and suggestions with regard to this article. Please feel free to contact us!

Don’t be caught off guard by broken pipelines, poor code, or user interactions that corrupt your data. Install Manifest Data, and you will know about issues before anyone. You can fix data problems silently before the business or customers are affected. Then get some rest!

Learn More