6.7

Although promiscuous mode can be useful for tracking network activity, it is an insecure mode of
operation, because any adapter in promiscuous mode has access to the packets even if some of the
packets are received only by a particular network adapter. This means that an administrator or root user
within a virtual machine can potentially view traffic destined for other guest or host operating systems.
See the vSphere Networking documentation for information about configuring the virtual machine adapter
for promiscuous mode.
Note In some situations, you might have a legitimate reason to configure a standard or a distributed
virtual switch to operate in promiscuous mode, for example, if you are running network intrusion detection
software or a packet sniffer.
Standard Switch Protection and VLANs
VMware standard switches provide safeguards against certain threats to VLAN security. Because of the
way that standard switches are designed, they protect VLANs against a variety of attacks, many of which
involve VLAN hopping.
Having this protection does not guarantee that your virtual machine configuration is invulnerable to other
types of attacks. For example, standard switches do not protect the physical network against these
attacks; they protect only the virtual network.
Standard switches and VLANs can protect against the following types of attacks.
MAC flooding Floods a switch with packets that contain MAC addresses tagged as having
come from different sources. Many switches use a content-addressable
memory table to learn and store the source address for each packet. When
the table is full, the switch can enter a fully open state in which every
incoming packet is broadcast on all ports, letting the attacker see all of the
switch’s traffic. This state might result in packet leakage across VLANs.
Although VMware standard switches store a MAC address table, they do
not get the MAC addresses from observable traffic and are not vulnerable
to this type of attack.
802.1q and ISL tagging
attacks
Force a switch to redirect frames from one VLAN to another by tricking the
switch into acting as a trunk and broadcasting the traffic to other VLANs.
VMware standard switches do not perform the dynamic trunking required
for this type of attack and, therefore, are not vulnerable.
Double-encapsulation
attacks
Occur when an attacker creates a double-encapsulated packet in which the
VLAN identifier in the inner tag is different from the VLAN identifier in the
outer tag. For backward compatibility, native VLANs strip the outer tag from
transmitted packets unless configured to do otherwise. When a native
VLAN switch strips the outer tag, only the inner tag is left, and that inner tag
routes the packet to a different VLAN than the one identified in the now-
missing outer tag.
vSphere Security
VMware, Inc. 200