Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Recently, using VMWare Player, I have configured a Linux virtual machine on a Windows host. I set the network adapter to be a bridged network with the Replicate option checked. The IP address was on the physical network but using the command arp -a will result differently between the host and the virtual machine--the host can spot other hosts on the Wi-Fi network while the VM cannot.

Knowing that the host is like a switch that forwards the network information to the VM, I think the VM is able to access the real network, but I cannot understand why it cannot. I want to know how exactly this bridged network works and if I can grab the actual network inside the virtual machine.

--- edit ---

The funny thing is that I see some but not all results through arp-scan -l

Here is the output:

  1. arp -a result on Windows host
  2. arp result on Linux VM
  3. arp-scan -l on VM

  'arp -a' result on Windows host   'arp' result on Linux VM   'arp-scan -l' on VM

share|improve this question
    
I think an arp -n; ip adds ls; ip route ls output for both the host and the guest were useful to get a good answer. –  Peter Horvath Nov 26 '13 at 23:19
    
Please provide output of what you're seeing. –  slm Nov 26 '13 at 23:39
    
@slm I have added the output –  Default-Cat Nov 27 '13 at 1:55
    
@MaXX 'arp -n' results in nothing; I don't get the second command; 'ip route' does not do much either. –  Default-Cat Nov 27 '13 at 1:57

3 Answers 3

I'm not entirely sure your assumption is correct. I regularly use bridged network devices and its been my experience that the network traffic for one of the VMs is somewhat isolated. I use KVM but the bridging technology I use are what are offered by the Linux host, so I would imagine they're maybe not identical but similar.

Also your use of arp confuses me. That command just shows what systems have recently been contacted by a system, and they're MAC address to IP address mappings are maintained in the systems ARP cache. The command arp is displaying the contents of this cache.

Example

I have a VM host + 1 guest.

host

$ arp -a
hostX (192.168.1.226) at XX:XX:XX:XX:XX:XX [ether] on br0
hostY (192.168.1.7) at XX:XX:XX:XX:XX:XX [ether] on br0
hostZ (192.168.1.5) at XX:XX:XX:XX:XX:XX [ether] on br0
hostA (192.168.1.1) at XX:XX:XX:XX:XX:XX [ether] on br0

guest

$ arp -a
hostA (192.168.1.1) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostY (192.168.1.7) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostB (192.168.1.100) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostC (192.168.1.8) at XX:XX:XX:XX:XX:XX [ether] on eth0
hostX (192.168.1.226) at XX:XX:XX:XX:XX:XX [ether] on eth0

Bridges are Layer 2 devices, so I wouldn't expect to see any evidence of arp data on the VM host, from the VM guest.

excerpt - 9.2.5. Network Bridge - Redhat docs

A network bridge is a Link Layer device which forwards traffic between networks based on MAC addresses and is therefore also referred to as a Layer 2 device. It makes forwarding decisions based on tables of MAC addresses which it builds by learning what hosts are connected to each network. A software bridge can be used within a Linux host in order to emulate a hardware bridge, for example in virtualization applications for sharing a NIC with one or more virtual NICs.

Debugging this further?

I would employee the networking analysis tool tcpdump on both the guest and host VMs. This will likely show you where the bottleneck is.

$ sudo tcpdump -i eth0

Change the argument to -i for which ever network interface you'd like to monitor.

share|improve this answer
    
+1 Perhaps nmap would provide more data on which hosts are really visible from within the VM. –  Joseph R. Nov 27 '13 at 7:51
    
@JosephR. - either that or tcpdump. –  slm Nov 27 '13 at 7:57

The arp(8) command shows the contents of the translation tables used by the Address Resolution Protocol by the OS; the table mostly consists of the cached replies to the local arp who-has requests.

If you have a virtual machine, with bridged networking, but which is not actively communicating with any of the hosts on the local network, then its arp table is likely to be pretty small.

Likewise, if you have several local networks on the host, but you only bridge one of such networks to the VM, then you're not actually bridged to the other networks, now are you?

It may sound like you've bridged the GigE, without bridging the WiFi.

Or, perhaps, you've bridged the WiFi, but the access point doesn't like your new MAC address.

share|improve this answer
    
I tried configuring the adapter to be used but it didn't work out. I don't know how to actively communicate with other hosts through a virtual machine either. But, yeah, probably it's because of my MAC address. –  Default-Cat Nov 27 '13 at 1:59

Based on the pictures you've attacked — arp -n returning absolutely nothing on your Linux VM — it sounds like you've simply forgot to configure the IP address within Linux, hence you're getting no ARP entries whatsoever.

Did you configure a static allocation within Linux manually, or are you running a dhclient within your Linux VM? You didn't provide even any ifconfig output to be able to discern the problem further.

You might also have to consider that maybe your access point may not like you to be extending its network.

share|improve this answer
    
my machine replicates the physical network and the IP address is 192.168.1.13, which is recognized by the host. –  Default-Cat Nov 27 '13 at 3:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.