How to recognise a VMware's virtual machine by its MAC address | FAQ | MAC Address Vendor Lookup
Frequently asked questions
? ? ?

How to recognise a VMware's virtual machine by its MAC address

Summary

# Range or Prefix Vendor Virtual Machine
1 00:50:56 VMWare VMware vSphere, VMware Workstation, VMware ESX Server
2 00:50:56:80:00:00 → 00:50:56:BF:FF:FF VMWare VMware vSphere managed by vCenter Server
3 00:0C:29 VMWare Standalone VMware vSphere, VMware Workstation, VMware Horizon
4 00:05:69 VMWare VMware ESX, VMware GSX Server
5 00:1C:14 VMWare VMWare

OUIs registered by VMWare, Inc

There are 4 OUIs registered by VMware, Inc:

OUI Assignment Type
00:50:56 MA-L
00:1C:14 MA-L
00:0C:29 MA-L
00:05:69 MA-L

Detection Rule 1

Affects products: VMware vSphere, VMware Workstation, VMware ESX Server

Signature: OUI is 00:50:56

Conditions

When the administrator assigns the MAC address manually to a virtual machine, this OUI prefix is set automatically. The last 3 octets should be set manually.

However, administrators can set any MAC address to their virtual machines.

Administrators can set any MAC address to their virtual machines

References

Example MACs generated

  • 00:50:56:11:22:33
  • 00:50:56:12:23:34
  • 00:50:56:33:A1:BB

Tested on

  • VMware vSphere 5.5, standalone
  • VMware VMware Workstation 15

Detection Rule 2

Affects products: VMware vSphere managed by vCenter Server

Signature: MAC address belongs to the range [00:50:56:80:00:00; 00:50:56:BF:FF:FF]

Conditions

According to the VMware OUI allocation scheme, a MAC address has the format of 00:50:56:XX:YY:ZZ, where 00:50:56 represents the VMware OUI, XX is calculated as (80 + vCenter Server ID), and YY and ZZ are random two-digit hexadecimal numbers.

Based on this scheme, we can determine the vCenter Server Unique ID, from the servers' MAC address:

  • Take the 4th octet: for 00:50:56:97:12:34, it would be 97
  • Subtract 0x80: 0x97 - 0x80 = 0x17
  • Rebase it from Base-16 to to Base-10. In our example, it would be 0x17 → 23
  • vCenter Server Unique ID = 23
We can determine the vCenter Server Unique ID, from the servers' MAC address

References

Example MACs generated

  • 00:50:56:A5:12:34
  • 00:50:56:A5:A0:12
  • 00:50:56:90:A4:BA

Tested on

  • vCenter Server 5.5, 6.5

Detection Rule 3

Affects products: Standalone VMware vSphere, VMware Workstation, VMware Horizon

Signature: OUI is 00:0C:29

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:0C:29 and the last three octets of the virtual machine UUID in hexadecimal format. The virtual machine UUID is based on a hash calculated by using the UUID of the ESXi physical machine and the path to the configuration file (.vmx) of the virtual machine.

The virtual machine UUID is based on a hash calculated
The virtual machine UUID is based on a hash calculated

References

Example MACs generated

  • 00:0C:29:4E:C6:49
  • 00:0C:29:49:92:99
  • 00:0C:29:5C:F3:BA

Tested on

  • vSphere 5.5, 6.5, VMware Workstation 15

Detection Rule 4

Affects products: Outdated VMWare solutions: VMware ESX, VMware GSX Server

Signature: OUI is 00:05:69

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:05:69 and the last three octets generated by the following algorithm:

  • The first 16 bits are set to the same values as the last 16 bits of the console operating system’s primary IP address.
  • The final eight bits of the MAC address are set to a hash value based on the name of the virtual machine’s configuration file.

For example, if a machine's IP address was 192.34.14.81 (or in hex, 0xc0220e51) and the configuration file was hashed to the value of 95, the MAC address would have the following value: 00:05:69:0e:51:95

References:

Example MACs generated

  • 00:05:69:0e:51:95

Detection Rule 5

Affects products: VMware products

Signature: OUI is 00:1C:14

References:

Example MACs generated

  • 00:1C:14:00:11:22

Virtual Machine’s MAC ranges

Have questions?

We work hard to improve our services for you. As part of that process we welcome your feedback, questions and suggestions. Please let us know your thoughts and feelings, and any way in which you think we can improve our product.

Shoot us an email to support@macaddress.io or just fill in the contact form.

The data was just refreshed