[Solved] Nmap and vbox NAT setting question

I am just curious about something and was wondering if anyone could shed light on it…

I tried using nmap on the Kali vbox instance but instead of using the Bridged setting for the network adapter I left it at NAT. So my command was like so:

nmap -T4 -F 10.0.2.0/24

and the Kali vbox OS was on 10.0.2.15.

This ends up showing 3 additional hosts at 10.0.2.2 - .4 with several Open/filtered ports. Is this something that VirtualBox does via its NAT functionality?

I assume/hope its normal, but I’m just really curious what these are for, etc.

Nat or bridged makes no difference with nmap. Only with wireshark and tcpdump.

What did nmap identify the hosts as? What ports were open?

Does they have the same mac address as the kali vm?

I finally dug into the Virtual Box manual and it looks like this is normal VBox behavior for the NAT option. Check out this section of the User Manual:

"9.11.1 Configuring the address of a NAT network interface

In NAT mode, the guest network interface is assigned to the IPv4 range 10.0.x.0/24 by default where x corresponds to the instance of the NAT interface +2. So x is 2 when there is only one NAT instance active. In that case the guest is assigned to the address 10.0.2.15, the gateway is set to 10.0.2.2 and the name server can be found at 10.0.2.3. " … etc.

Right ok yes that’s true. Cool. Its things like this that make you learn!