Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Identifying virtual machines attempting to use promiscuous network mode on ESX/ESXi (1023341)

Last Updated: 3/20/2024Categories: How toTotal Views: 37013Language:
JapaneseEnglish

3 like this article

Subscribe to get an email
newsletter with new updates

3 people found this helpful Please provide article feedback:

Symptoms

The VMkernel logs at /var/log/vmkernel or /var/log/messages contain entries similar to:

cpuN:nnnn)etherswitch: L2Sec_EnforcePortCompliance: 0xnnnnnnnn: peer not allowed promiscuous, revoking setting

accessing-network vm-network configure-promiscuous-mode vm-support-esx-logs

Purpose

These messages from the ESX/ESXi VMkernel indicate that a virtual machine is trying to promiscuously capture all network traffic on a vSwitch portgroup, but the vSwitch portgroup policy is configured to deny promiscuous mode. No warning is emitted for virtual machines attached using promiscuous mode when it is permitted by the effective vSwitch portgroup policy.

By default, a guest operating system's virtual network adapter only receives frames that are meant for it. Placing the guest's network adapter in promiscuous mode causes it to receive all frames passed on the virtual switch that are allowed under the VLAN policy for the associated portgroup. This can be useful for intrusion detection monitoring or if a sniffer needs to to analyze all traffic on the network segment. For more information, see Configuring promiscuous mode on a virtual switch or portgroup (1004099).

If software within a virtual machine is attempting to put the guest network adapter in promiscuous mode, contrary to the defined vSwitch portgroup policy, it may be necessary to investigate if the virtual machine is running undesired software.

This article provides steps for identifying a virtual machine that attempts to promiscuously capture all network traffic on a vSwitch portgroup, based upon the VMkernel log messages. Investigation within a virtual machine is outside the scope of this article.

Resolution

The log message identifies a specific virtual network interface on an ESX or ESXi host by its PortID. This identifier is not displayed in the vSphere Client, but can be associated with a virtual machine by searching the performance metrics for all virtual machine network interfaces on the host.

To identify which virtual machine is attempting to enter promiscuous mode, convert the logged hexadecimal port identifier to a base 10 number and locate the virtual machine using that port number.

From the VMkernel log message, identify the virtual machine world number and port identifier. For example:

cpuN:12345)etherswitch: L2Sec_EnforcePortCompliance: 0x5000003: peer not allowed promiscuous, revoking setting

In this example, the world number is 12345 and the port identifier is 0x5000003.

Convert the hexadecimal port identifier to base-10 decimal. For example, base-16 port number 0x5000003 is 83886083 in base-10.

Map the base-10 decimal port identifier to a virtual machine name using one of these methods:

Using PowerCLI

Using resxtop in the vCLI or vMA

Using esxtop at the ESX/ESXi host console

Using esxcfg-info at the ESX/ESXi host console

Each method provides the virtual machine world number and name. Locate the virtual machine by name using the vSphere Client and optionally investigate its adherence to security policies.

Identifying a virtual machine by port identifier using the PowerCLI

For more information on installation and use of PowerCLI, see the VMware vSphere PowerCLI documentation.

To identify a virtual machine by its base-10 port identifier using the PowerCLI:

Open the PowerCLI command prompt.

Connect to the ESX or ESXi host which reported the warning using the command:

Connect-VIServer -Server <ESXHostnameOrIPAddress>

Note: Authenticate using an administrative user, such as root.

Fetch the esxtop performance counter name matching the port identifier using a command similar to:

Get-ESXTOP -CounterName NetPort | select PortID,WorldLeader,ClientName | Where { $_.PortID -eq "83886082" } | ft -AutoSize

The output appears similar to:

PortID WorldLeader ClientName
------ ----------- ----------
83886082 12344 VirtualMachineName

The virtual machine world number and name are available. Locate the virtual machine in the vSphere Client and optionally begin investigation.

Identifying a virtual machine by port identifier using resxtop

The remote resxtop command-line performance monitoring utility is included in the vSphere CLI for Linux and in the vMA. For more information on use of resxtop, see Performance Monitoring Utilities in the vSphere Resource Management Guide for your version of ESX/ESXi. For more information on installation, see the vSphere Command-Line Interface documentation.

To identify a virtual machine by its base-10 port identifier using resxtop:

Open a command prompt where the vCLI is installed.

Define a variable containing the port identifier using a command similar to:

PORTID="83886082"

Fetch the performance counter name matching the port identifier the command:

resxtop --server <ESXHostnameOrIPAddress> --username <Username> -n 1 -b | tr ',' '\n' | grep -o "Network Port(.*:$PORTID:.*)" | sort -u

Note: Authenticate using an administrative user, such as root.

The output appears similar to:

Network Port(vSwitchName:83886082:12344:VirtualMachineName)

The virtual machine world number and name are available. Locate the virtual machine in the vSphere Client and optionally begin investigation.

Identifying a virtual machine by port identifier using esxtop

The esxtop command-line performance monitoring utility is included the local ESX/ESXi console. For more information on use of esxtop, see Performance Monitoring Utilities in the vSphere Resource Management Guide for your version of ESX/ESXi.

To identify a virtual machine by its base-10 port identifier using esxtop:

Open a console to the ESX or ESXi host. For more information, see Unable to connect to an ESX host using Secure Shell (SSH) (1003807) or Using Tech Support Mode in ESXi 4.1 (1017910).

Define a variable containing the port identifier using a command similar to:

PORTID="83886082"

Fetch the performance counter name matching the port identifier using the command:

esxtop -n 1 -b | tr ',' '\n' | grep -o 'Network Port(.*:$PORTID:.*) ' | sort -u

Note: Authenticate using an administrative user, such as root.

The output appears similar to:

Network Port(vSwitchName:83886082:12344:VirtualMachineName)

The virtual machine world number and name are available. Locate the virtual machine in the vSphere Client and optionally begin investigation.

Identifying a virtual machine by port identifier using esxcfg-info

The local esxcfg-info command-line utility is included the local ESX/ESXi console. This command provides a view of the internal state of various components.

To identify a virtual machine by its base-10 port identifier using the output of esxcfg-info:

Open a console to the ESX or ESXi host. For more information, see Unable to connect to an ESX host using Secure Shell (SSH) (1003807) or Using Tech Support Mode in ESXi 4.1 (1017910).

Parse the section of esxcfg-info output matching the port identifier using a command similar to:

esxcfg-info --network | grep -A 3 "Port Id.*83886082"

The output appears similar to:

|----Port Id..........83886082
|----World Leader.....12344
|----Client Name......VirtualMachineName

The virtual machine world number and name are available. Locate the virtual machine in the vSphere Client and optionally begin investigation.

Related Information

ESX/ESXi で無差別ネットワーク モードを使用しようとしている仮想マシンを特定する

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

KB
•
Como configurar ou restaurar a rede do console de serviço ESX usando console-setup (1022078)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware ESX Server

Related Versions:

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESXi 4.0.x Installable

VMware ESXi 4.0.x Embedded

VMware ESXi 3.5.x Installable

VMware ESXi 3.5.x Embedded

VMware ESX Server 3.5.x

VMware ESX Server 3.0.x

VMware ESX 4.1.x

VMware ESX 4.0.x

view all

Take Our Survey

Support Assistant