I noticed an IP conflict today on a windows box hosted on the ESXi. In the events viewer under system I checked the MAC address of the system trying to hijack my IP address. I wanted to find a quick way and check if this mac address is in my existing ESXi Virtual Machines or it’s outside somewhere..
I wanted to find a quick and dirty way to check this since there is number of machines on the ESXi host.
Here is what I did…

I opened VMWare VI-TOOLKIT. After I connected I decided to try some commands that I regularly use such as get-vm and get-vmguest. After I found nothing interesting I checked out the CI Toolkit Cmdlets Reference Document.

And there it was… the perfect command for what I wanted..

Get-NetworkAdapter … Wooohoo!

[VI Toolkit] C:\Program Files\VMware\Infrastructure\VIToolkitForWindows> Get-NetworkAdapter -vm (get-vm *)|select MacAddress

MacAddress
———-
07:0c:29:11:61:6a
07:0c:29:6a:4a:db
07:0c:29:a4:ae:6f
07:0c:29:0c:c7:4c
07:0c:29:d5:8c:4f
07:0c:29:27:4d:84
07:0c:29:7c:e9:23
07:0c:29:52:52:aa
07:0c:29:eb:e3:e6
07:0c:29:17:66:50
07:0c:29:21:09:70
07:0c:29:81:89:3d
07:0c:29:0e:d6:ce
07:50:56:3f:51:02
07:0c:29:ad:60:61
07:0c:29:40:84:06
07:0c:29:40:84:10
07:0c:29:ce:89:9c
07:50:56:3f:51:01
00:1b:29:a0:ff:fe
00:1b:29:e2:ea:d5
00:1b:29:e2:ea:df
00:1b:29:e2:ea:e9
00:1b:29:07:f1:f9
00:1b:29:07:f1:03
00:1b:29:e8:8b:dd
00:1b:29:e8:8b:e7
00:1b:29:e8:8b:f1
00:50:56:3f:51:03
00:1b:29:ba:4c:b9
00:1b:29:84:2b:62
00:1b:29:2c:9d:6c
00:1b:29:7d:98:0e
00:1b:29:6a:1a:a5
00:1b:29:5a:82:cf
00:1b:29:26:23:bf
00:1b:29:df:87:1c

The MAC I was looking for was not here but this is a proof that none of the machines in my control is attempting the hijacking.