Differentiate VMware network adapter from physical network adapters -or- Detect Virtual Network Adaptor

Question

I have to differentiate between the real addresses and the VM addresses using any Windows API. I\'m using GetAdaptersAddresses API to populate a list of IP addr

Answer 1

I found a site to get more complete list of MAC address prefix, after reading clyfe answer.

Please visit: Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

For example: VirtualBox has 17 MAC prefix!

Prefix  Vendor
000F4B  Virtual Iron Software, Inc. (was: Katana Technology)
001307  Paravirtual Corporation (was: Accenia, Inc.)
0013BE  Virtual Conexions
0021F6  Virtual Iron Software
00240B  Virtual Computer Inc.
00A0B1  First Virtual Corporation
00E0C8  virtual access, ltd.
545200  linux kernal virtual machine (kvm)
000F4B  Virtual Iron Software, Inc. (was: Katana Technology)
001307  Paravirtual Corporation (was: Accenia, Inc.)
0013BE  Virtual Conexions
0021F6  Oracle Corporation (was: Virtual Iron Software)
00240B  Virtual Computer Inc.
00A0B1  First Virtual Corporation
00E0C8  virtual access, ltd.
18922C  Virtual Instruments
3CF392  Virtualtek. Co. Ltd

At the end I preferred to detect Virtual network adapter from its 'Network Card Description'. If I see 'Virtual' or 'VMWare' word in it description (C++: IP_ADAPTER_INFO::Description), I will assume it is virtual network adapter.

Answer 2

You can pass NetworkInterface in below method and it will return boolean to indicate that the NIC is Physical or not.

        private static bool IsPhysicalAdapter(NetworkInterface ni)
        {
           bool isPhysical = false;

           ManagementObjectSearcher searcher = new 
                              ManagementObjectSearcher(@"root\CIMV2", 
                              string.Format(@"SELECT * FROM  Win32_NetworkAdapter 
                              WHERE GUID='{0}' AND NOT PNPDeviceID LIKE 'ROOT\\%'", 
                              ni.Id));

           foreach (ManagementObject share in searcher.Get())
           {
                isPhysical = 
                   Convert.ToBoolean(share.Properties["PhysicalAdapter"].Value);
                break;
           }

           return isPhysical;
        }

Answer 3

The beginning (first 3 segments) of the mac address shows if a interface is virtual:

"00:05:69"; //vmware1
"00:0C:29"; //vmware2
"00:50:56"; //vmware3
"00:1C:42"; //parallels1
"00:03:FF"; //microsoft virtual pc
"00:0F:4B"; //virtual iron 4
"00:16:3E"; //red hat xen , oracle vm , xen source, novell xen
"08:00:27"; //virtualbox

EDIT
To be more clear, if a interface has a MAC address that starts with any of the above given strings, then it's virtual.