Cupfighter.net

For troubleshooting purposes sometimes it might be usefull to perform a tcpdump on the ESXi host instead of from a VM.

After removing the security setting in the dvPortGroup explicitly allowing promiscous mode you can connect a vmkernle port to the dvPortGroup and perform a tcpdump via the commandline

The help for tcpdump-uw is the following:


~ # tcpdump-uw --help
tcpdump-uw version 4.0.0
libpcap version 1.0.0
Usage: tcpdump-uw [-aAdDefIKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                [ -i interface ] [ -M secret ] [ -r file ]
                [ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ]
                [ -y datalinktype ] [ -z command ] [ -Z user ]
                [ expression ]

Control+C to interrupt the capture

By Christiaan Beek

From isfullofcrap Flickr photo stream. Creative Commons License

BlackhatEU : Virtual Forensics
By Christiaan Beek

What are the challenges when you have to do forensics on a virtual environment?
•    What are the tools available?
•    Are the tools forensically sound?
•    Where is the data?
•    Who owns the data?
•    What forensic techniques do we use?
•    How to acquire data from the cloud?

Citrix is a nightmare for forensics investigators. There is no personal hard disk to investigate, only a personal profile which does not have very much data in it.
Read more…

Kostya started of by telling everybody: “I’m not a virtualisation expert”

Then he started to explain how he was able to build up his cloudburst exploit.he focused on the guest os devices, because the device are omnipresent in all VMWare pruducts, they run on the host, can be accessed from the guest, are written in C/C++ and parse some complex data.

Read more…

VMware has released Labmanager for Vpshere 4. http://www.vmware.com/products/labmanager/

VMware vCenter Lab Manager is the ideal solution for IT organizations who want to provide self-service provisioning and management capabilities to internal teams. Policy-based access control reduces administrative burden for IT, lowers infrastructure management costs and empowers project teams to deliver applications more quickly and with greater agility.

Deliver Higher Service Levels and Lower Infrastructure Costs

Lab Manager offers unique capabilities to simplify management of the internal cloud for dev/test:

• Self Service Portal – Provides on-demand access to a library of virtual machine configurations for end users while eliminating time-consuming provisioning tasks for IT by 95%.
• Automated Resource Management – Allows dynamic allocation of resources in a multi-team environment, enforces quotas and access rights, and reclaims unused infrastructure services.

Enterprise Scalability – Provides long-term return on investment with a scalable architecture for worldwide deployment, best in class performance and seamless integrations with in-house and 3rd party solutions.

While doing some research found this article on the Pro’s and Con’s of stretched ESX cluster across two datacenters.

A stretched cluster is the practice of having ESX member servers in a cluster that are geographically separated.   The reason this is generally done is to provide the ability to dynamically move workloads from one datacenter to another.   Often, the customer is also considering it for disaster recovery purposes (“I’ll just VMotion in case of a disaster”).  Can this be done – ABSOLUTELY – but not considered lightly.

More here: http://virtualgeek.typepad.com/virtual_geek/2008/06/the-case-for-an.html

From: http://www.virtualization.info/2009/06/vmware-apologies-for-hyper-v-crashes.html

When we look at the competition in the IT industry there’s nothing that beats the marketing guerrilla we are experiencing in the virtualization space.

This is perfectly understandable considering that the vendor in control of the hypervisor is able to influence and in many ways able to control all the other companies that provide other pieces of the computing stack.
For the first time ever the absolute domain of the OS vendor is threatened by the hypervisor vendor so that the former tries to turn virtualization into a platform feature while the latter tries to impose the technology as absolutely independent.

It’s also true that compared to ten years ago the vendors have new tools to spread fear, uncertainty and doubts (FUD) against their competitors: paid bloggers, Twitter, Facebook, YouTube and so much more are available to influence the prospects and build armies of fanboys that are ready to overreact and defend their beloved products no matter what.

Nowadays is becoming increasingly common that marketing departments cross the line.
It’s much more uncommon to see a company that publicly apologies for a bad marketing action.

It’s the case of VMware which apologized for distributing a video of Microsoft Hyper-V crashing when its virtual machines were running a certain version of the proprietary VMmark benchmark platform.

The video, which was available here, was realized by the VMware Performance Team and uploaded on YouTube by Scott Drummonds, Technical Marketing Manager at the company.
Despite Drummonds is in the VMware Performance Team, where every aspect of the virtual infrastructure is taken deadly seriously, he didn’t publish any technical information about the test environment.

The lack of details unleashed a number of negative comments obliging Bruce Herndon, Senior Manager of R&D at VMware, to unveil that VMmark was executed inside Hyper-V virtual machines with unsupported configurations.

At the end of the saga Drummonds had to apology and Herndon had to admit that:

One of the more interesting emails I received pointed out that it unreasonable to blame Hyper-V for the collapse of these very large and very busy websites. Hyper-V’s stability issues would bring down individual VMs or small groups when the parent partition blue screened. I think that this is a reasonable observation, so its worth including here. I can’t say that Hyper-V was responsible for the MSDN and TechNet crashes. That would be for Microsoft to say, when and if they choose to expose the issue behind the outage.

Of course Microsoft couldn’t be happier to overreact: part 1, part 2, part 3, part 4 and part 5.

From http://www.virtualization.info/2009/06/microsoft-launches-visual-studio-lab.html

The few vendors busy in the virtual lab automation space (which include VMware, Surgient, VMLogix, Skytap and the almost died StackSafe) may soon have a big, big problem called Microsoft.

After wasting years not leveraging its huge developers community to spread virtualization in every corner of the world, the company is finally moving on.

Announced in November 2008, the integration between Visual Studio 2010, System Center Virtual Machine Manager (SCVMM) 2008 and Hyper-V 1.0/2.0 for virtual lab automation scenarios is now a reality called Visual Studio 2010 Lab Management.

The product just entered the beta 1 phase and has the potential to become a huge hit in the .NET world.

more

Some nice articles which explain timekeeping on vmware and how to virtualize Active Directory safely on VMWare time wise.

Time synchronisation on Active Directory is particularly important because of Kerberos, if clocks are more then 5 minutes (Default value) out of sync from the Domain Controller authentication fails. NTP is your friend here.

• Timekeeping in VMWare virtual machines
• TAC 9710 -Virtualizing a Windows Active Directory Domain Infrastructure (From 2006 but still usefull especially the Active Directory related inf0)