Frequently asked questions

How to recognise a VMware's virtual machine by its MAC address?

Summary

#	Range or Prefix	Vendor	Virtual Machine

1	00:50:56	VMWare	VMware vSphere, VMware Workstation, VMware ESX Server
2	00:50:56:80:00:00 → 00:50:56:BF:FF:FF	VMWare	VMware vSphere managed by vCenter Server
3	00:0C:29	VMWare	Standalone VMware vSphere, VMware Workstation, VMware Horizon
4	00:05:69	VMWare	VMware ESX, VMware GSX Server
5	00:1C:14	VMWare	VMWare

OUIs registered by VMWare, Inc

There are 4 OUIs registered by VMware, Inc:

OUI	Assignment Type

00:50:56	MA-L
00:1C:14	MA-L
00:0C:29	MA-L
00:05:69	MA-L

Detection Rule 1

Affects products: VMware vSphere, VMware Workstation, VMware ESX Server

Signature: OUI is 00:50:56

Conditions

When the administrator assigns the MAC address manually to a virtual machine, this OUI prefix is set automatically. The last 3 octets should be set manually.

However, administrators can set any MAC address to their virtual machines.

References

Example MACs generated

00:50:56:11:22:33
00:50:56:12:23:34
00:50:56:33:A1:BB

Tested on

VMware vSphere 5.5, standalone
VMware VMware Workstation 15

Detection Rule 2

Affects products: VMware vSphere managed by vCenter Server

Signature: MAC address belongs to the range [00:50:56:80:00:00; 00:50:56:BF:FF:FF]

Conditions

According to the VMware OUI allocation scheme, a MAC address has the format of 00:50:56:XX:YY:ZZ, where 00:50:56 represents the VMware OUI, XX is calculated as (80 + vCenter Server ID), and YY and ZZ are random two-digit hexadecimal numbers.

Based on this scheme, we can determine the vCenter Server Unique ID, from the servers' MAC address:

Take the 4th octet: for 00:50:56:97:12:34, it would be 97
Subtract 0x80: 0x97 - 0x80 = 0x17
Rebase it from Base-16 to to Base-10. In our example, it would be 0x17 → 23
vCenter Server Unique ID = 23

References

Official Documentation: VMware OUI Allocation for VMware vSphere 6.7

Example MACs generated

00:50:56:A5:12:34
00:50:56:A5:A0:12
00:50:56:90:A4:BA

Tested on

vCenter Server 5.5, 6.5

Detection Rule 3

Affects products: Standalone VMware vSphere, VMware Workstation, VMware Horizon

Signature: OUI is 00:0C:29

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:0C:29 and the last three octets of the virtual machine UUID in hexadecimal format. The virtual machine UUID is based on a hash calculated by using the UUID of the ESXi physical machine and the path to the configuration file (.vmx) of the virtual machine.

The virtual machine UUID is based on a hash calculated

References

Example MACs generated

00:0C:29:4E:C6:49
00:0C:29:49:92:99
00:0C:29:5C:F3:BA

Tested on

vSphere 5.5, 6.5, VMware Workstation 15

Detection Rule 4

Affects products: Outdated VMWare solutions: VMware ESX, VMware GSX Server

Signature: OUI is 00:05:69

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:05:69 and the last three octets generated by the following algorithm:

The first 16 bits are set to the same values as the last 16 bits of the console operating system’s primary IP address.
The final eight bits of the MAC address are set to a hash value based on the name of the virtual machine’s configuration file.

For example, if a machine's IP address was 192.34.14.81 (or in hex, 0xc0220e51) and the configuration file was hashed to the value of 95, the MAC address would have the following value: 00:05:69:0e:51:95