How to recognise a VMware's virtual machine by its MAC address

Summary

OUIs registered by VMWare, Inc

There are 4 OUIs registered by VMware, Inc:

Detection Rule 1

Affects products: VMware vSphere, VMware Workstation, VMware ESX Server

Signature: OUI is 00:50:56

Conditions

When the administrator assigns the MAC address manually to a virtual machine, this OUI prefix is set automatically. The last 3 octets should be set manually.

However, administrators can set any MAC address to their virtual machines.

References

• Official Documentation: Setting a Static MAC Address to a Virtual Machine for VMware vSphere 6.7
• Official Documentation: VMware ESX Server 1.5 User’s Manual
• VM Ware Communities Forum
• Hey VM, What's Your Hypervisor?

Example MACs generated

• 00:50:56:11:22:33
• 00:50:56:12:23:34
• 00:50:56:33:A1:BB

Tested on

• VMware vSphere 5.5, standalone
• VMware VMware Workstation 15

Detection Rule 2

Affects products: VMware vSphere managed by vCenter Server

Signature: MAC address belongs to the range [00:50:56:80:00:00; 00:50:56:BF:FF:FF]

Conditions

According to the VMware OUI allocation scheme, a MAC address has the format of 00:50:56:XX:YY:ZZ, where 00:50:56 represents the VMware OUI, XX is calculated as (80 + vCenter Server ID), and YY and ZZ are random two-digit hexadecimal numbers.

Based on this scheme, we can determine the vCenter Server Unique ID, from the servers' MAC address:

• Take the 4th octet: for 00:50:56:97:12:34, it would be 97
• Subtract 0x80: 0x97 - 0x80 = 0x17
• Rebase it from Base-16 to to Base-10. In our example, it would be 0x17 → 23
• vCenter Server Unique ID = 23

References

• Official Documentation: VMware OUI Allocation for VMware vSphere 6.7

Example MACs generated

• 00:50:56:A5:12:34
• 00:50:56:A5:A0:12
• 00:50:56:90:A4:BA

Tested on

• vCenter Server 5.5, 6.5

Detection Rule 3

Affects products: Standalone VMware vSphere, VMware Workstation, VMware Horizon

Signature: OUI is 00:0C:29

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:0C:29 and the last three octets of the virtual machine UUID in hexadecimal format. The virtual machine UUID is based on a hash calculated by using the UUID of the ESXi physical machine and the path to the configuration file (.vmx) of the virtual machine.

References

• Official Documentation: MAC Address Generation on ESXi Hosts VMware vSphere 6.7
• Official Documentation: Maintaining and Changing MAC Addresses for Virtual Machines for VMware Workstation Pro 15
• Official Documentation: Specify a MAC Address Range for VMware Horizon FLEX

Example MACs generated

• 00:0C:29:4E:C6:49
• 00:0C:29:49:92:99
• 00:0C:29:5C:F3:BA

Tested on

• vSphere 5.5, 6.5, VMware Workstation 15

Detection Rule 4

Affects products: Outdated VMWare solutions: VMware ESX, VMware GSX Server

Signature: OUI is 00:05:69

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:05:69 and the last three octets generated by the following algorithm:

• The first 16 bits are set to the same values as the last 16 bits of the console operating system’s primary IP address.
• The final eight bits of the MAC address are set to a hash value based on the name of the virtual machine’s configuration file.

For example, if a machine's IP address was 192.34.14.81 (or in hex, 0xc0220e51) and the configuration file was hashed to the value of 95, the MAC address would have the following value: 00:05:69:0e:51:95

References:

• Official Documentation: VMware ESX Server 1.5 User’s Manual

Example MACs generated

• 00:05:69:0e:51:95

Detection Rule 5

Affects products: VMware products

Signature: OUI is 00:1C:14

References:

• Unofficial study guide: VMware vSphere 5.5 with ESXi and vCenter - Boot Camp by ESXLab

Example MACs generated

• 00:1C:14:00:11:22

Virtual Machine’s MAC ranges

• How to recognise a Parallels' virtual machine by its MAC address
• How to recognise a Docker container by its MAC address
• How to recognise a Microsoft Hyper-V's virtual machine by its MAC address
• How to recognise an Oracle Virtual machine by its MAC address