0

I am trying to do a malware analysis on Vmware. I have two virtual machines running - Windows XP and Windows 7.

I am using the Windows XP as the primary OS in VMware for Malware Analysis and it is configured on VM host only segment 18. While Windows 7 (installed in the Vmware) has two Virtual NIC installed. One connects to the internet and One connects to VM host only segment 18 (the same segment where Windows XP also connects)

I want that Windows XP internet traffic should go to Windows 7 first and then Windows 7 sends it to the internet. I have installed various network analysis tools on Windows 7 to capture the traffic sent by the malware in Windows xp.

Can any one help me achieve this scenario.

1 Answer 1

0

I think this requires that you use the Windows 7 box as a router for the traffic

Hopefully this covers all the points needed - generally I setup Linux VMs to do this now, but I believe I got this working with Windows 7.

Setup Windows 7 with two network cards - - Internal with IP 192.168.0.1 255.255.255.0 NO gateway
- External with IP address mask and gateway as required by your internet connection connected to the vSwitch connected to the physical adaptor which has access to the internet You will need to turn on the Routing and Remote access service

Windows Xp has one network adapter connected to vswitch Internal which the Internal card on the Windows 7 box is also connected to. Nothing else is connected to this vSwitch Windows XP IP address is IP 192.168.0.2 255.255.255.0 Gateway 192.168.0.1

If your using vmWorkstation it will not be vSwitches (I think) . I'm not sure that vmPlayer can do this.

1
  • My setup is Windows NIC has 10.0.0.8/24 and Windows 7 NIC1 has 10.0.0.9/24 and NIC2 is connected using NAT connection to the outside internet of the host PC. I have turned on IP routing and Routing service on Windows 7 but still I am not able to ping internet from Windows Xp but I am able to ping Windows 7 from Windows XP. Can you tell whats the issue?
    – Skynet
    Commented May 28, 2017 at 6:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .