How to recognise an Oracle Virtual machine by its MAC address?
Summary
| # | Range or Prefix | Vendor | Virtual Machine |
|---|---|---|---|
| 1 | 08:00:27 | Pcs Systemtechnik GmbH | Oracle VirtualBox 5.2 |
| 2 | 52:54:00 (Exact MAC: 52:54:00:C9:C7:04) | N/A | Oracle VirtualBox 5.2 + Vagrant |
| 3 | 00:21:F6 | Oracle Corp | Oracle VirtualBox 3.3 |
| 4 | 00:14:4F | Oracle Corp | Oracle VM Server for SPARC |
| 5 | 00:0F:4B | Oracle Corp | Oracle Virtual Iron 4 |
OUIs registered by Oracle corp
There are 15 OUI registered by Oracle corp:
| OUI |
Assignment Type |
|---|---|
| 00:10:E0 | MA-L |
| 00:00:7D | MA-L |
| 00:21:28 | MA-L |
| 00:01:5D | MA-L |
| 00:21:F6 | MA-L |
| 00:A0:A4 | MA-L |
| 00:07:82 | MA-L |
| 00:03:BA | MA-L |
| 08:00:20 | MA-L |
| 2C:C2:60 | MA-L |
| 00:10:4F | MA-L |
| 00:0F:4B | MA-L |
| 00:13:97 | MA-L |
| 00:20:F2 | MA-L |
| 00:14:4F | MA-L |
Only some of them are used for the Virtual Machines.
Detection Rule 1
Affects products: Oracle VirtualBox
Signature: OUI is 08:00:27
Details
Once new VM has been created with the VirtualBox GUI, it has a MAC address with OUI prefix set automatically. When the administrator presses "refresh" button, the last 3 octets are changed, but the prefix remains.
However, it's possible to set a custom MAC with any prefix.
Example MACs generated
- 08:00:27:3F:FE:0F
- 08:00:27:78:8D:0D
- 08:00:27:BB:05:3F
- 08:00:27:FD:B6:EF
References
Tested on
- VirtualBox 5.1.26
Detection Rule 2
Affects products: Oracle VirtualBox / Vagrant
Signature: Prefix is 52:54:00, or Prefix is 52:54:00:C9:C7:04
Details
Once a new VM has been created with the Vagrant, it sometimes has a MAC address with prefix 52:54:00. Some virtual machines have the same MAC: 52:54:00:C9:C7:04.
Example MACs generated
- 52:54:00:CA:E4:8B
- 52:54:00:C9:C7:04
Tested on
- VirtualBox 5.1.26
Detection Rule 3
Affects products: Oracle VirtualBox 3.3
Signature: OUI is 00:21:F6
Details
Oracle wrote in their blog that they used OUI 00:21:F6 for virtual machines. This VirtualBox version isn't supported anymore.
References
Detection Rule 4
Affects products: Oracle VM Server for SPARC
Signature: OUI is 00:14:4F
Details
Domains have been assigned the following block of 512K MAC addresses:
- 00:14:4F:F8:00:00 ~ 00:14:4F:FF:FF:FF
The lower 256K addresses are used by the Logical Domains Manager for automatic MAC address allocation, and you cannot manually request an address in this range:
- 00:14:4F:F8:00:00 - 00:14:4F:FB:FF:FF
You can use the upper half of this range for manual MAC address allocation:
- 00:14:4F:FC:00:00 - 00:14:4F:FF:FF:FF
References
Detection Rule 5
Affects products: Oracle Virtual Iron 4
Signature: OUI is 00:0F:4B
References
Virtual Machine’s MAC ranges
Trusted by the following companies
and many more...