Differentiate VMware network adapter from physical network adapters -or- Detect Virtual Network Adaptor

Question

I have to differentiate between the real addresses and the VM addresses using any Windows API. I'm using GetAdaptersAddresses API to populate a list of IP addresses for the local machine. I need to extract only the "real" addresses apart from the addresses associated with the VMware network adapter and other addresses (auto-configuration and tunnel adapter addresses). I've not been able to find any API or any flag to differentiate this. Is there any way this can be done?

PS: The IfType flag in the IP_ADAPTER_ADDRESSES structure returned by GetAdaptersAddresses doesn't help me differentiate between VMware addresses and the real addresses.

Please refer below link for more details. http://www.codesanitize.com/2021/04/c-how-to-get-network-adapter-status.html — Tony Stark, Apr 17 '21 at 11:02

score 17 · Accepted Answer · edited May 23 '17 at 11:46

17

The beginning (first 3 segments) of the mac address shows if a interface is virtual:

"00:05:69"; //vmware1
"00:0C:29"; //vmware2
"00:50:56"; //vmware3
"00:1C:42"; //parallels1
"00:03:FF"; //microsoft virtual pc
"00:0F:4B"; //virtual iron 4
"00:16:3E"; //red hat xen , oracle vm , xen source, novell xen
"08:00:27"; //virtualbox

EDIT
To be more clear, if a interface has a MAC address that starts with any of the above given strings, then it's virtual.

edited May 23 '17 at 11:46

Community

1
1

answered Jun 17 '10 at 14:47

clyfe

23,695
8
85
109

2

just wanted to add some links: use this link - http://standards.ieee.org/regauth/oui/index.shtml to find id reservations. Reverse operation can be performed here: http://coffer.com/mac_find/ – Andrey Jun 17 '10 at 18:08
This doesn't exactly answer the question: how do we know from the company name if it's virtual or not? – Gyuri Oct 29 '10 at 00:05
What do you mean by "from the company name"? – clyfe Oct 29 '10 at 20:48
1

Why VirtualBox MAC addresses are not listed anywhere? `0A:00:27` which is used by VBox 5 is not listed anywhere! The old one `08:00:27` is listed as "Cadmus Computer Systems". https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob_plain;f=manuf – Ajay Mar 23 '16 at 05:38
Please refer below link for more details. http://www.codesanitize.com/2021/04/c-how-to-get-network-adapter-status.html – Tony Stark Apr 17 '21 at 11:03

score 3 · Answer 2 · answered Dec 01 '20 at 12:11

You can pass NetworkInterface in below method and it will return boolean to indicate that the NIC is Physical or not.

        private static bool IsPhysicalAdapter(NetworkInterface ni)
        {
           bool isPhysical = false;

           ManagementObjectSearcher searcher = new 
                              ManagementObjectSearcher(@"root\CIMV2", 
                              string.Format(@"SELECT * FROM  Win32_NetworkAdapter 
                              WHERE GUID='{0}' AND NOT PNPDeviceID LIKE 'ROOT\\%'", 
                              ni.Id));

           foreach (ManagementObject share in searcher.Get())
           {
                isPhysical = 
                   Convert.ToBoolean(share.Properties["PhysicalAdapter"].Value);
                break;
           }

           return isPhysical;
        }

Note the mem leak: ManagementObjectSearcher is disposable – DAG Jun 07 '22 at 17:53 — DAG, Jun 07 '22 at 17:53

score 2 · Answer 3 · edited May 23 '17 at 12:02

I found a site to get more complete list of MAC address prefix, after reading clyfe answer.

Please visit: Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

For example: VirtualBox has 17 MAC prefix!

Prefix  Vendor
000F4B  Virtual Iron Software, Inc. (was: Katana Technology)
001307  Paravirtual Corporation (was: Accenia, Inc.)
0013BE  Virtual Conexions
0021F6  Virtual Iron Software
00240B  Virtual Computer Inc.
00A0B1  First Virtual Corporation
00E0C8  virtual access, ltd.
545200  linux kernal virtual machine (kvm)
000F4B  Virtual Iron Software, Inc. (was: Katana Technology)
001307  Paravirtual Corporation (was: Accenia, Inc.)
0013BE  Virtual Conexions
0021F6  Oracle Corporation (was: Virtual Iron Software)
00240B  Virtual Computer Inc.
00A0B1  First Virtual Corporation
00E0C8  virtual access, ltd.
18922C  Virtual Instruments
3CF392  Virtualtek. Co. Ltd

At the end I preferred to detect Virtual network adapter from its 'Network Card Description'. If I see 'Virtual' or 'VMWare' word in it description (C++: IP_ADAPTER_INFO::Description), I will assume it is virtual network adapter.

How do you handle non-English "Description" ? – Ajay Mar 23 '16 at 05:56 — Ajay, Mar 23 '16 at 05:56

Differentiate VMware network adapter from physical network adapters -or- Detect Virtual Network Adaptor

3 Answers3

Linked