Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
Cheers Tony
Tony Mountifield wrote:
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
This paper show some very interesting tricks:
http://handlers.sans.org/tliston/ThwartingVM*Detection*_Liston_Skoudis.pdf
One simple (but not really foolproof, and only for VMWare) is testing the MAC address, and look at the OUI bytes; these are assigned to VMWare:
00-05-69 00-0C-29 00-1C-14 00-50-56
In article 48886F83.6090707@xplanation.com, Paul Bijnens paul.bijnens@xplanation.com wrote:
Tony Mountifield wrote:
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
This paper show some very interesting tricks:
http://handlers.sans.org/tliston/ThwartingVM*Detection*_Liston_Skoudis.pdf
Interesting link (once I'd removed the * characters) - thanks!
Cheers Tony
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Tony Mountifield
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
Cheers Tony
This script does the trick for me on ESX 3 by looking at the (virtual) hardware description. But it probably is not foolproof.
if ( `/sbin/lspci | grep -qi vmware` ) || \ ( `grep -qi vmware /proc/scsi/scsi` ); then echo "This is a Virtual Machine." Fi
Marc-Andre
Marc-Andre Levesque wrote:
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Tony Mountifield
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
Cheers Tony
This script does the trick for me on ESX 3 by looking at the (virtual) hardware description. But it probably is not foolproof.
if ( `/sbin/lspci | grep -qi vmware` ) || \ ( `grep -qi vmware /proc/scsi/scsi` ); then echo "This is a Virtual Machine." Fi
Marc-Andre
Alternatively, grep the output from dmidecode for VMware:
dmidecode | grep VMware
You'll get output from VMware Server, I've not tested with other VMware products.
On Thu, July 24, 2008 7:47 am, Tony Mountifield wrote:
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
dmidecode | grep -iq " vmware "
This returns 0 if it is a VMware system and 1 it it isn't.
In article g69q3o$f9v$1@softins.clara.co.uk, Tony Mountifield tony@softins.clara.co.uk wrote:
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
Thanks for the responses. Grepping for VMware in /proc/scsi/scsi or the output from dmidecode look to be the most reliable options.
Cheers Tony
Tom Brown wrote:
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
# dmidecode | grep Product Product Name: VMware Virtual Platform
mmm....
a XEN VPS gives me this:
# dmidecode | grep Product /dev/mem: mmap: Bad address
Tony Mountifield wrote on Thu, 24 Jul 2008 11:47:04 +0000 (UTC):
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
AFAIK, VMWare uses vmnet32 drivers for ethernet and possibly others for other devices as well.
Kai
Kai Schaetzl wrote:
Tony Mountifield wrote on Thu, 24 Jul 2008 11:47:04 +0000 (UTC):
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
AFAIK, VMWare uses vmnet32 drivers for ethernet and possibly others for other devices as well.
indeed.
# modinfo vmxnet filename: /lib/modules/2.6.18-5-486/misc/vmxnet.ko author: VMware, Inc. description: VMware Virtual Ethernet driver. ...
# dmesg |grep -i vmware hdc: VMware Virtual IDE CDROM Drive, ATAPI CD/DVD-ROM drive Vendor: VMware, Model: VMware Virtual S Rev: 1.0 VMware hgfs: HGFS is disabled in the host VMware hgfs: HGFS is disabled in the host VMware memory control driver initialized VMware vmxnet virtual NIC driver
...
on 7-25-2008 12:57 PM mouss spake the following:
Kai Schaetzl wrote:
Tony Mountifield wrote on Thu, 24 Jul 2008 11:47:04 +0000 (UTC):
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
AFAIK, VMWare uses vmnet32 drivers for ethernet and possibly others for other devices as well.
indeed.
# modinfo vmxnet filename: /lib/modules/2.6.18-5-486/misc/vmxnet.ko author: VMware, Inc. description: VMware Virtual Ethernet driver. ...
# dmesg |grep -i vmware hdc: VMware Virtual IDE CDROM Drive, ATAPI CD/DVD-ROM drive Vendor: VMware, Model: VMware Virtual S Rev: 1.0 VMware hgfs: HGFS is disabled in the host VMware hgfs: HGFS is disabled in the host VMware memory control driver initialized VMware vmxnet virtual NIC driver
...
Most of those depend on your installing vmware tools package and their drivers.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Tony Mountifield wrote: | Does anyone know how a program, script or shell user can best determine | whether the machine is running on bare metal or is a VMware guest? |
Obviously from the responses many people have a solution... my question is "Why do you care?".
What is it that you would do (or not do) on a vmware guest that you might do on bare metal?
- -- Milton Calnek BSc, A/Slt(Ret.) milton@calnek.com 306-717-8737
Tony Mountifield wrote: | Does anyone know how a program, script or shell user can best determine | whether the machine is running on bare metal or is a VMware guest? |
Obviously from the responses many people have a solution... my question is "Why do you care?".
What is it that you would do (or not do) on a vmware guest that you might do on bare metal?
install VMware tools perhaps?
In article 4888ABCA.8000203@calnek.com, Milton Calnek milton@calnek.com wrote:
Tony Mountifield wrote: | Does anyone know how a program, script or shell user can best determine | whether the machine is running on bare metal or is a VMware guest? |
Obviously from the responses many people have a solution... my question is "Why do you care?".
What is it that you would do (or not do) on a vmware guest that you might do on bare metal?
Just trying to understand a 3rd party setup where I was pretty sure one of their hosts was a vmware guest, but they didn't believe it was! (it was set up for them by someone else)
Cheers Tony