VMware adapters keep appearing as new network devices

GlassWire Help
1

In my Network tab, I always have 4 VMware devices present.

Please see the attached screenshot.

I know what the ones marked in green are. They’re the virtual adapters that exist on my the 2 virtual subnets that VMware creates for host-only networking and NAT. I’ve labelled those 2 devices in Glasswire and they remain constant.

The other 2 devices, marked in red, I’m not clear about. They don’t correspond with any virtual network adapters visible on my system, and I can’t even see them if I run ‘ipconfig /all’. But the thing that’s annoying is that they keep reappearing in Glasswire. After each reboot, I’m alerted that they are “new” devices that have connected to the network. This also means I can’t label them, because each time they come back as new devices that are unlabelled.

Is there anything that can be done about these 2 mystery ones marked in red? Either to not detect them as network devices (which I’m sure they shouldn’t be detected as anyway), or some way to choose to ignore them completely?

2

I’m pretty sure that local IP addresses x.x.x.254 are automatically created by VMWare on your virtual adapters as a virtual default gateway for each subnet - just as you have a default gateway on your physical subnet. You should be able to change them or remove them. I did a very quick search and this tutorial illustrates what it looks like when they are not set. You should be able to find a tutorial that sets them.

You can confirm if I’m correct by using the following command and checking that the default gateway addresses match:

ipconfig /all

3

Those IP addresses are not configured as gateways for the VMware adapters.

Ethernet adapter VMware Network Adapter VMnet1:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet1
   Physical Address. . . . . . . . . : 00-50-56-C0-00-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::cdbb:c07f:6997:3b35%20(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.126.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 100683862
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-D3-86-B1-00-1F-D0-9B-21-8C
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet8:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet8
   Physical Address. . . . . . . . . : 00-50-56-C0-00-08
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::e09c:9ec8:c17e:4ecc%5(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.237.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 184569942
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-D3-86-B1-00-1F-D0-9B-21-8C
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled
4

I haven’t used VMWare this decade, so I presume that it doesn’t show up because DHCP is disabled. But I still expect x.x.x.254 to be the reserved address for the default gateway which would normally be your DHCP host.

5

@harkonnen

If you go to all your network devices and choose them and just disable them, do they go away? Or do they not appear under your network devices?

6

Hi @Ken_GlassWire

They do not appear under my network devices.

7

@Ken_GlassWire

Please can you check with the developer if anything can be done for it. I would like to leave the ‘Network device monitor’ alerts enabled, to know if anything unexpected connects to my network, but for now it is really annoying to keep receiving new alerts for these 2 “devices” (as their MAC addresses change after every reboot).

8

@harkonnen

I checked.

For us Vmware does not change the MAC address of the devices after each reboot. So we would recommend to find out the reason why Vmware does this for you. We are just getting the data from the OS, so the data we show is actually accurate.

Google “vmware static mac address” and there is a lot of information about it.

9

@Ken_GlassWire

Just to make sure we’re talking about the same thing: Can you confirm that you also have all 4 of the kinds of VMware “devices” in my screenshot in the first post. And in particular, 2 devices with IP addresses ending in 254 (the DHCP reserved IPs). Because those ones ending in 254 are the problematic ones. Can you confirm, specifically, that you’ve noticed that the MAC addresses of your devices ending in .254 keep the same MAC address across reboots?

10

@harkonnen

I see four VMWare devices, but for me they are static and never change. Two of mine end in 254. I have never seen a notice from GlassWire about something changing with them.

11

Well it’s a mystery then. This is my setup, which is what VMware Workstation set up by default. I wonder why the default behavior is different on your systems.

virtual_network.png590×526 15.8 KB