how to know the remote machine is Virtual machine or physical machine
 

Hi All,

when i see the out put of cat /proc/cpuinfo
48bit for vm
38bit for physical

or their is any way to identify that this is a vm or physical machine


Thanks
dk

Hi there,

that looks like lottery numbers to me. Neither of these make sense.

If the virtualization software is any good, you cannot tell the difference between a virtual and a physical machine by software. That's the idea, after all. There may be some subtle hints from which you can guess that you're running on or talking to a VM; but generally, the intention is that the VM is not distinguishable from a real physical machine.

[X] Doc CPU

Usually there is a specific set of tools on a box that is a vm client. It would vary depending virtual system used. For instance VMware has a VMware-toolkit on its clients.


AND - What he/she is referring to is address sizes

which in this case really has no reference to a "virtual machine"

The virtual aspect there refers to memory.

CPU cores can be virtual as well as physical. For instance usually w/an 8 core processor 4 of them are physical and other 4 are virtual.

That just specifies how many bits can fit in each address or "memory slot"

Below is a good image on wikipedia that shows dataflow in an 8 core processor

http://upload.wikimedia.org/wikipedi..._core_CPU).PNG

Hi
its not a lottery numbers & focus on my machine out put this could be a ESX or vm on ESX ????

I am getting the access from ssh (putty) & i need to fill some inventory sheets so that,s why i needed these information

I just ran this command in one of my virtual system, and found several /proc files that contained virt inside them.

find /proc -type f -exec grep -l virt '{}' 2>/dev/null ';' 2>/dev/null

Perhaps a check for virtio_balloon.*Live in /proc/modules would do the trick. :scratch: That one is alive in my virtual systems but not in the host system. (virtio_net is live in the host and the virtuals.) If you've accessed the system over a network, I think that the virtio net access stuff needs to be running. But I'm not a virtual developer, and one of them might have a better answer.

That line in the output has nothing to do with running in a vm, it's part of Physical Address Extensions.

Detecting if a host is running within a virtual machine is tricky because you have to rely on specific odd behaviours in each virtualiser.

Have a look at Detect if you are Running a Virtual Machine | CodeHill or How to detect virtualization or any number of other pages for some ideas and some scripts you can examine.

I think it would be unusual for CPU info from /proc/cpuinfo in a virtual machine to differ from the info of the underlying machine. That would mean the virtualization software has gone to extra effort to do a worse job of simulating a real CPU.

Anyway, 48bit virtual addressing should be standard across all X86_64 CPUs regardless of physical machine vs. virtual machine, while physical addressing will vary by CPU, 38bit is a reasonable amount and I can't think of any reason virtualization software might want to pretend the physical addressing is different from that of the real CPU.

The words "virtual" and "physical" in computer systems have many different meanings. Maybe you did a blind search on those words. "Virtual machine" is a specific computer concept that is quite different from the many other things that "virtual" means.

The links SecretCode provided look plausible to me. I'm not at all expert in how to detect a virtual machine. I'm only saying that /proc/cpuinfo is not likely to be a good place to try to get that answer.

Thanks to all(johnsfine,renholme,SecretCode,kbscores,Doc CPU)

now i found the simplest command

interesting

dmidecode by itself I found virtual mentioned a few times

dmidecode | grep -i "Virtual"

Version: VirtualBox
Product Name: VirtualBox
Family: Virtual Machine

I don't think that dmidecode | grep -i vm is (close to) infallible.

On my host system I getwhile, on the virtual system I get

Hi,

I got the same output on my VPS which is a virtual machine.

but when i ran the above command this give me output

Can we just believe on the same output to decide that the machine is virtual. I've tested this on near 10 machines
it works the same way.

Hi All,


So is their is any better way to find that this is a physical or virtual machine.

When i am looking for the difference between the VM or physical machine i notice that virtual machine have all most same output

this is the output which i am getting from the vmware workstation 8 rhel5.5 & ESX Virtual machine


This is the output from ESX box virtual machine rhel5.5

That is true because you were (obviously) using VMware as your virtual manager. Not every virtual system uses VMware.

In fact, I have my virtuals running under qemu-kvm using Fedora's virtual manager, and, as I noted above, the suggested "test" does not produce any output when run on a Fedora 17 virtual system.

The virt-what script (in the first reference of post 6 by Secret Code) returns KVM for that virtual system.

Hi PTrenholme,

"Thanks for view"
yes that's right every virtual system doesn't uses VMware so their out put dmidecode | grep -i "vm" also not same.
but i have to differentiate between the vm & physical so that's why i do that.

A thought: If you use the converse of your original question to ask "How can I tell if I'm running on a non-virtual system?" would the reply of "VME (Virtual mode extension)" be sufficient? (Assuming, of course, that anyone offing a server of which would want to ask the question would be using a modern processor.) :scratch:

yes in the beginning i am confusing, but now i am clear about it, their is also a common thing in the output of the Virtual machine
i don't know why this is same!!!!! in each "vmware" virtual-machine

Get the vendor information
 

cat /sys/class/dmi/id/sys/vendor

From VM you will get

cat /sys/class/dmi/id/sys_vendor
VMware, Inc.

From Dell box you will get
cat /sys/class/dmi/id/sys_vendor
Dell Inc.

Simple & Straight forward :)
 

dmidecode -s system-product-name

Surely the way one tell the difference between VMs and real ones is looking at the records and change paperwork? for an audit of even a badly-run network you ought to know, at lest, which VM[s] to expect .
Apologies for the cynicism but I'm not sure why this needs to be asked?

Some reasons...
 

* Maybe you are asked to report the percentage of VMs in a customer's network you are assessing
* Define which virtualization platform is being used to mitigate related vulnerabilities
* Audit purposes: assure specific network subnet for VMs, ....
* Servers foot printing before an attack you will do!

It could be anything, dealing with various setups leads to unexpected questions. Trust me