Promiscuous mode for VMware Workstation adapter on Windows host?

[bzp...@gmail.com]

I cannot find any documentation on how to add an adapter to VMware Workstation Player and set it to promiscuous mode.
There is a VMware article on how to do it for Linux host but none for Windows host that I could find.

Has anyone done this?

Thanks
Ben

[Wes Lambert]

Ben,

It should be under the VM Settings >> Add >> Network Adapter.  You can then run Setup to configure the specific adapter/interface as a sniffing interface.

Thanks,
Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[BZPerry]

No promiscuous mode option there 

Just Bridged with replicate physical network connection state extra option, NAT, and Host-only

You received this message because you are subscribed to a topic in the Google Groups "security-onion" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/security-onion/0dJzs_jPcYI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.

[Wes Lambert]

Ben,

Please note, the Security Onion Setup script puts the adapter into promiscuous mode when it is run.

Thanks,
Wes

On Nov 21, 2016 12:26 AM, "BZPerry" <bzp...@gmail.com> wrote:

No promiscuous mode option there 

Just Bridged with replicate physical network connection state extra option, NAT, and Host-only

On Nov 21, 2016, at 12:52 AM, Wes Lambert <wlamb...@gmail.com> wrote:

Ben,

It should be under the VM Settings >> Add >> Network Adapter.  You can then run Setup to configure the specific adapter/interface as a sniffing interface.

Thanks,
Wes

On Nov 20, 2016 11:44 PM, <bzp...@gmail.com> wrote:

I cannot find any documentation on how to add an adapter to VMware Workstation Player and set it to promiscuous mode.
There is a VMware article on how to do it for Linux host but none for Windows host that I could find.

Has anyone done this?


Thanks
Ben

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.

To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

--

Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to a topic in the Google Groups "security-onion" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/security-onion/0dJzs_jPcYI/unsubscribe.

To unsubscribe from this group and all its topics, send an email to security-onion+unsubscribe@googlegroups.com.

To post to this group, send email to security-onion@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[B Z Perry]

Thanks for your help Wes but there is a Security Onion document "IntroductionWalkthrough"

https://github.com/Security-Onion-Solutions/security-onion/wiki/IntroductionWalkthrough

where it talks about installing Security Onion in VirtualBox and says:

Next click "Network" then "Adapter 2." You'll need to click the checkbox to enable it then attach it to "Internal Network." Under the "Advanced" options, set "Promiscuous Mode" to "Allow All." Click "Ok" and we are ready to install the operating system.

So I would rather not rely on the setup scripts to put the adapter into promiscuous mode as I would like the sniffing adapter to receive all traffic designated for any MAC address and not just broadcast packets

[Wes]

> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.

>
> To post to this group, send email to securit...@googlegroups.com.
>
> Visit this group at https://groups.google.com/group/security-onion.
>
> For more options, visit https://groups.google.com/d/optout.
>
>
>
>
>
>
> --
>
> Follow Security Onion on Twitter!
>
> https://twitter.com/securityonion
>
> ---
>
> You received this message because you are subscribed to a topic in the Google Groups "security-onion" group.
>
> To unsubscribe from this topic, visit https://groups.google.com/d/topic/security-onion/0dJzs_jPcYI/unsubscribe.
>

> To unsubscribe from this group and all its topics, send an email to security-onio...@googlegroups.com.

>
> To post to this group, send email to securit...@googlegroups.com.
>
> Visit this group at https://groups.google.com/group/security-onion.
>
> For more options, visit https://groups.google.com/d/optout.
>
>
>
>
>
>
> --
>
> Follow Security Onion on Twitter!
>
> https://twitter.com/securityonion
>
> ---
>
> You received this message because you are subscribed to the Google Groups "security-onion" group.
>

> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.

>
> To post to this group, send email to securit...@googlegroups.com.
>
> Visit this group at https://groups.google.com/group/security-onion.
>
> For more options, visit https://groups.google.com/d/optout.
>
>
>
>
>
>
> --
>
> Follow Security Onion on Twitter!
>
> https://twitter.com/securityonion
>
> ---
>
> You received this message because you are subscribed to a topic in the Google Groups "security-onion" group.
>
> To unsubscribe from this topic, visit https://groups.google.com/d/topic/security-onion/0dJzs_jPcYI/unsubscribe.
>

> To unsubscribe from this group and all its topics, send an email to security-onio...@googlegroups.com.

>
> To post to this group, send email to securit...@googlegroups.com.
>
> Visit this group at https://groups.google.com/group/security-onion.
>
> For more options, visit https://groups.google.com/d/optout.

Ben,

If I want the NIC to monitor traffic on the physical network, I'll usually configure the NIC as 'bridged' and then run setup to configure the sniffing interface appropriately.

Thanks,
Wes