Our MAC Address API outputs a field called macAddressDetails.virtualMachine. If it detects that a Virtual Machine is using this MAC address, it outputs its vendor name (e.g. ”VMWare”). Otherwise, it outputs “Not detected”.
To detect the Virtual Machines, we build our VM Knowledge Base, which stores information about known relations between MAC addresses and Virtual Machines, and patterns, based on which the Virtual Machines assign MAC addresses to the virtual network interfaces.
This information comes from the two sources:
- We constantly scan the Internet for such information. It’s systemized, stored and verified.
- Our research team installed the Virtual Machines and performed experiments, trying to identify patterns on how their network interfaces receive MAC addresses.
Virtual Machine’s MAC ranges
- How to recognise a VMware's virtual machine by its MAC address?
- How to recognise a Parallels' virtual machine by its MAC address?
- How to recognise a Docker container by its MAC address?
- How to recognise a Microsoft Hyper-V's virtual machine by its MAC address?
- How to recognise an Oracle Virtual machine by its MAC address?
Detection rules which don't have their dedicated page yet
| Virtual Machine Name | OUI or range | References |
|---|---|---|
| Red Hat Xen, XenSource, Novell Xen | 00:16:3E:00:00:00 to 00:16:3E:FF:FF:FF | Making sure you're not a bot! Hey VM, What's Your Hypervisor? -- Microsoft Certified Professional Magazine Online https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms |
| Microsoft SCVMM (System Center Virtual Machine Manager) | 00:1D:D8:B7:1C:00 to 00:1D:D8:F4:1F:FF | http://techgenix.com/mac-address-pool-duplication-hyper-v/ https://docs.microsoft.com/en-us/system-center/vmm/network-mac?view=sc-vmm-1807 https://blogs.technet.microsoft.com/gbanin/2014/08/27/how-to-solve-mac-address-conflict-on-hyper-v/ |
| Microsoft Virtual PC / Virtual Server | 00:03:FF:00:00:00 to 00:03:FF:FF:FF:FF | Hey VM, What's Your Hypervisor? -- Microsoft Certified Professional Magazine Online https://www.techrepublic.com/blog/data-center/mac-address-scorecard-for-common-virtual-machine-platforms/ https://blogs.technet.microsoft.com/medv/2011/01/24/how-to-manage-vm-mac-addresses-with-the-globalimagedata-xml-file-in-med-v-v1/ |
| SWsoft | 00:18:51:00:00:00 to 00:18:51:FF:FF:FF | Hey VM, What's Your Hypervisor? -- Microsoft Certified Professional Magazine Online |
| bhyve by FreebsdF | 58:9C:FC:00:00:00 to 58:9C:FC:FF:FF:FF | https://macaddress.io/statistics/company/17619 |
| Nutanix AHV | 50:6B:8D:00:00:00 to 50:6B:8D:FF:FF:FF | https://macaddress.io/statistics/company/17388 |
| KVM (proxmox) | 54:52:00:00:00:00 to 54:52:FF:FF:FF:FF | https://www.centos.org/forums/viewtopic.php?t=26739 |
| Hetzner vServer (based on KVM and libvirt) | 96:00:00:00:00:00 to 96:00:FF:FF:FF:FF | Self tested |
We are warmly welcoming your thoughts and suggestions with regard to this article. Please feel free to contact us!
