Penetration Testing mailing list archives

Re: VMWare and which linux distro?


From: Martin Mačok <martin.macok () underground cz>
Date: Mon, 19 Jan 2004 08:51:32 +0100

On Sat, Jan 17, 2004 at 01:17:22AM +0100, Pete Herzog wrote:

In our testing lab, we have seen some problems with the sending and
receiving of various types of TCP / UDP packets from within
a Virtual Machine as part of an attack system.

What problems? Some deterministic behaviour or "random" stuff?
Corruption?

Source and Destination ports, for instance, comes to mind as an
example of the corruption occurring with tests.

Do you use NAT for VM Networking?

Our suspician is a corruption which occurs in the binding with the
ethernet card and regardless of OS or whether the VM has it's own
external IP address or not, it still occurs enough that we had to
stop using a VM to make tests from.

VM with external IP address ... that means you use the Bridged mode VM
Networking?

We have not done any further tests on this.  Has anyone else seen
this problem though?  Anyone have more information on this?

I don't. I use Linux as a primary/host OS for doing most of the tests
and VMWare/Windows just for doing some MS Windows-only things which
are usually application level works and not low level networking
stuff. It also makes me feel better to have MS Windows as the OS that
is sandboxed :-)

-- 
         Martin Mačok                 http://underground.cz/
   martin.macok () underground cz        http://Xtrmntr.org/ORBman/

---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: