How to detect a Virtual Machine by its MAC address?
Our MAC Address API outputs a field called macAddressDetails.virtualMachine. If it detects that a Virtual Machine is using this MAC address, it outputs its vendor name (e.g. ”VMWare”). Otherwise, it outputs “Not detected”.
To detect the Virtual Machines, we build our VM Knowledge Base, which stores information about known relations between MAC addresses and Virtual Machines, and patterns, based on which the Virtual Machines assign MAC addresses to the virtual network interfaces.
This information comes from the two sources:
- We constantly scan the Internet for such information. It’s systemized, stored and verified.
- Our research team installed the Virtual Machines and performed experiments, trying to identify patterns on how their network interfaces receive MAC addresses.
Virtual Machine’s MAC ranges
- How to recognise a VMware's virtual machine by its MAC address?
- How to recognise a Parallels' virtual machine by its MAC address?
- How to recognise a Docker container by its MAC address?
- How to recognise a Microsoft Hyper-V's virtual machine by its MAC address?
- How to recognise an Oracle Virtual machine by its MAC address?
Detection rules which don't have their dedicated page yet
| Virtual Machine Name | OUI or range | References |
|---|---|---|
| Red Hat Xen, XenSource, Novell Xen | 00:16:3E:00:00:00 to 00:16:3E:FF:FF:FF |
https://wiki.xenproject.org/wiki/Xen_Networking https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx |
| Microsoft SCVMM (System Center Virtual Machine Manager) | 00:1D:D8:B7:1C:00 to 00:1D:D8:F4:1F:FF |
http://techgenix.com/mac-address-pool-duplication-hyper-v/ https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807 https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/ |
| Microsoft Virtual PC / Virtual Server | 00:03:FF:00:00:00 to 00:03:FF:FF:FF:FF |
https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx |
| SWsoft | 00:18:51:00:00:00 to 00:18:51:FF:FF:FF |
https://mcpmag.com/articles/2007/11/27/hey-vm-whats-your-hypervisor.aspx |
| bhyve by FreebsdF | 58:9C:FC:00:00:00 to 58:9C:FC:FF:FF:FF | |
| Nutanix AHV | 50:6B:8D:00:00:00 to 50:6B:8D:FF:FF:FF | |
| KVM (proxmox) | 54:52:00:00:00:00 to 54:52:FF:FF:FF:FF | |
| Hetzner vServer (based on KVM and libvirt) | 96:00:00:00:00:00 to 96:00:FF:FF:FF:FF |
Self tested |
We are warmly welcoming your thoughts and suggestions with regard to this article. Please feel free to contact us!
Trusted by the following companies
and many more...