Re: Re: changing mac addresses of clients in vmware

In my whitepaper, "Creating Virtual Honeynets with Connectix Virtual PC 5=
.2" (http://www.rit.edu/~arl7969/whitepapers/alamb-4-2004.html) I discuss=
 one way to workaround virtual machines' MAC addresses.

I'm not sure if this works for VMWare, but:

"The solution I found to be most effective for minimizing the influence o=
f the host was the following. First, the host computer's TCP/IP protocol =
was disabled. Second, because of the nature of the network that the host =
was attached to, I =93spoofed=94 the MAC address of the guest machine so =
that the guest's virtual interface had the same MAC address as the host's=
 physical interface. I then set the Virtual PC networking mode to Virtual=
 Switch with access to the external network only (See the next section fo=
r a discussion of network modes in Virtual PC). The virtual machine was t=
herefore able to connect to the public network directly through it's virt=
ual interface using the host's physical interface. The host firewall was =
still able to continue logging the virtual machine's traffic without tran=
slating these packets through the host's TCP/IP stack.

Spoofing MACs can be done relatively easy on most Operating Systems; in t=
he case of the Windows 98 honeypot it is only a matter of adding a new re=
gistry string value (=93NetworkAddress=94 in HKEY_LOCAL_MACHINE\System\Cu=
rrentControlSet\Services\Class\Net\000) equal to the MAC address of the h=
ost. For the OpenBSD honeypot, MAC address manipulation is not available =
by default, but using Doug Song's popular sea.c one can alter the MAC add=
ress of the virtual ethernet card. With this configuration I was only abl=
e to allow one honeypot access to the network, running two honeypots with=
 the same MAC address or the host and a guest with the same MAC caused co=
nnection drops."

There is also this: http://www.softpedia.com/get/Tweak/Network-Tweak/VMwa=
re-MAC-Changer.shtml