dup ping replies from vbox guest to vmware guest

[haughki]

VirtualBox VM 5.1.28 r117968,
guest additions installed in guest
Host:
Windows 7 64bit
OS Release: 6.1.7601
OS Service Pack: 1
Host RAM: 24559MB (23.9GB) total, 13938MB (13.6GB) available

Guest:
ubuntu 16.04 LTS 64bit
6GB RAM, 5 available
150GB hd, 100 free

VBox.log and VBoxHardening.log:

logs.zip

VBox.log and VBoxHardening.log

(61.1 KiB) Downloaded 9 times

The other guest I'm pinging: ubuntu 14.04 LTS

All of the guests are bridged, getting dhcp from my router. I can ping the host and other physical devices (and vice versa) on the network as well as external hosts with no problems. Only get the dup response when I try to ping one of the two other vms (or vice versa) which are both hosted by vmware (I need to use vmware for these). E.g.,

Code: Select all

hawk@Tug:~$ ping 10.0.0.12
PING 10.0.0.12 (10.0.0.12) 56(84) bytes of data.
64 bytes from 10.0.0.12: icmp_seq=1 ttl=64 time=2.93 ms
64 bytes from 10.0.0.12: icmp_seq=1 ttl=64 time=2.99 ms (DUP!)
64 bytes from 10.0.0.12: icmp_seq=2 ttl=64 time=0.989 ms
64 bytes from 10.0.0.12: icmp_seq=2 ttl=64 time=1.26 ms (DUP!)
64 bytes from 10.0.0.12: icmp_seq=3 ttl=64 time=0.563 ms
64 bytes from 10.0.0.12: icmp_seq=3 ttl=64 time=0.605 ms (DUP!)
^C
--- 10.0.0.12 ping statistics ---
3 packets transmitted, 3 received, +3 duplicates, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 0.563/1.558/2.993/1.023 ms

Here's some networking config info for the guests:

Code: Select all

VirtualBox Guest
hawk@Tug:~$ ifconfig -a
eth0      Link encap:Ethernet  HWaddr 08:<redacted>  
          inet addr:10.0.0.14  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::c24b:5f7f:e130:43c3/64 Scope:Link
          inet6 addr: fe80::6ffe:1d96:1d2d:1e9b/64 Scope:Link
          inet6 addr: fe80::db3f:d7ae:ac27:a5f0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7464 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1629 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:749675 (749.6 KB)  TX bytes:221414 (221.4 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:913 errors:0 dropped:0 overruns:0 frame:0
          TX packets:913 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:174862 (174.8 KB)  TX bytes:174862 (174.8 KB)

		  
hawk@Tug:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        *               255.255.255.0   U     100    0        0 eth0
link-local      *               255.255.0.0     U     1000   0        0 eth0


VmWare Guest
indeni@indeni-server:~$ ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:<redacted>
          inet addr:10.0.0.12  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe6d:5871/64 Scope:Link
          inet6 addr: 2601:647:304:6900:20c:29ff:fe6d:5871/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1626 errors:0 dropped:0 overruns:0 frame:0
          TX packets:576 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:154709 (154.7 KB)  TX bytes:77779 (77.7 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:103186 errors:0 dropped:0 overruns:0 frame:0
          TX packets:103186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:11702763 (11.7 MB)  TX bytes:11702763 (11.7 MB)

		  
indeni@indeni-server:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.0.0.1        0.0.0.0         UG    0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth0

[haughki]

I "fixed" this by converting my virtualbox vm into a vmware vm. Not what I wanted to do, but I needed to move forward.

It's a really strange issue (to me), and I just don't know if I have the networking chops to work through it on my own.

[Irre Levant]

Dont know if thats the same cause. The forum is full of those posts and i guess they are all based on the same cause:

If you start using default nat vms and switch to bridged network later on virtualbox is setting a virtual mac address to this vm. If you do this with just one vm its fine. The host does forward packets to this vm. But if you do this with a second vm virtualbox sets the vm to the SAME mac address. The host does forward each packet to both of the vms. You have to regenerate the mac addresses in advanced network options so every vm does have its own virtual mac address and the host can send the packets to the individual vms!

[mpack]

But if you do this with a second vm virtualbox sets the vm to the SAME mac address.

VirtualBox does not use the same MAC address in a clone unless you explicitly tell it to - i.e. the default is not.

If we aren't talking clones then VirtualBox never assigns the same MAC to a new VM.

Best guess... I think you might be talking about IP addresses, not MACs. The MAC assignment is permanent for a VM and is not affected by your decision to use NAT, NAT network, Bridged etc. However if the default NAT is used then every VM is in its own virtual network and will be assigned the same 10.x IP address by NAT DHCP. Other network modes will do something else appropriate for that network mode.

[fth0]

In addition to what mpack wrote, there is a situation where multiple VMs would be seen with the same MAC address:

If the VMs are bridged to a physical WiFi network adapter on the host, the network traffic from each guest to other endpoints on the WiFi network or beyond (e.g. your router) uses the host adapter's MAC address (a type of MAC-level NAT). Note that this should only apply to network traffic outside of the host, not to network traffic between the guests, unless the latter gets routed over your router.

[Irre Levant]

But if you do this with a second vm virtualbox sets the vm to the SAME mac address.

VirtualBox does not use the same MAC address in a clone unless you explicitly tell it to - i.e. the default is not.

If we aren't talking clones then VirtualBox never assigns the same MAC to a new VM.

Best guess... I think you might be talking about IP addresses, not MACs. The MAC assignment is permanent for a VM and is not affected by your decision to use NAT, NAT network, Bridged etc. However if the default NAT is used then every VM is in its own virtual network and will be assigned the same 10.x IP address by NAT DHCP. Other network modes will do something else appropriate for that network mode.

No i am not talking about ip addresses it just happened to me. Multiple vms (clones) resulted in having the exact same mac address after changed the clones to bridged networking. This was resulting in traffic duplications and was fixed by regenerate the mac addresses. I dont know if thats a bug in my version (6.1.38@ubuntu) or something expected.

[fth0]

VirtualBox does not use the same MAC address in a clone unless you explicitly tell it to - i.e. the default is not.

It looks like we were both wrong and Irre Levant is right:

The default setting in VirtualBox 6.1.48 and 7.0.12 is "Include only NAT network adapter MAC addresses", which means that the MAC addresses of NAT network adapters are kept when cloning a VM. I just checked it in the VirtualBox Manager and in the VirtualBox source code.