Honeypots: Re: Kernel & VMware bridging - Whats the difference?

[Jay Beale <jay () bastille-linux org>]

Rock Lobster wrote:
> Lately, I've been attempting to setup a GenII honeypot on my laptop with vmware.
>
> I do have a couple of questions that I can't quite work out though.
>
> When I compiled my host o/s kernel I forgot to enable bridging and TUN/TAP support,
> which according to the UML linux paper I read is required for the 
brctl package to
> work.  Now the things is,  because bridging wasnt enabled in my 
kernel intially,
> why did the vmware guest o/s get an IP from my dhcp server and manage 
to sit
> happily on my network without any problem?

vmware installs its own modules into the kernel, which means they can 
include any code they want.  Their modules' networking capability 
includes bridging, but wouldn't have to use the existing bridging 
functionality.  It probably doesn't in fact, especially since the Linux 
bridging wasn't massively well-tested or standard in the kernel when 
VMware released its first workstation product.
With that said, UML does use the Linux kernel's bridging functionality 
by Stephen Hemminger.  This makes sense for many reasons, most 
especially that UML is a patch to the mainstream kernel code.

  - Jay

> I'm also curious as to why I couldnt just install the brctl package and then have 
> the product of vmnet0 placed into my iptables rules accordingly?  Why 
doesnt vmnet0
> show up as another network device when I 'ifconfig -a'
> Thanks!