I've an ESX based Cuckoo Sandbox setup with 25 workers, consisting both Windows 7 x86 (10 vms) and x64 (15 vms). Virtual networking is configured via promiscuous mode on both the ESX virtual switch and the controller.
When I scan a few files I get correct reports but when I submit files more than the number of available workers, I start seeing the "Error from the Cuckoo Guest: cuckoo2: guest communication timeout: unable to upload agent, check networking or try to increase timeout" error in reports. All such reports are incomplete because analysis didn't complete. I found a malwr.com report with the same error: https://malwr.com/analysis/NDdhY2Q0YjU1YzYzNDIyMTk1NDAzMDgxMDk4OGUyMmQ/
I also see high memory utilization alarms on individual workers when this happens. I've configured Windows 7 x86 workers with 2GB memory and x64 workers with 4GB memory. All workers have Python 2.7 and latest agent.py from Cuckoo GIT repo (master branch).
My questions to the community are:
1. Is the "guest communication timeout" error, in some way, related to high memory usage alarm I see on workers? What would be the recommended memory setting for Windows 7 x86 and x64 workers?
2. Is the promiscuous mode setting recommended on an ESX based setup? Controller and workers are in the same subnet and TCP:8000 ports on all workers are reachable from controller. If promiscuous mode is disabled, I only see broadcast requests (LLMNR and WINS) in Cuckoo reports.
I'm debugging this error at my end as well and will keep everyone updated. Thanks in advance for taking time to answer these questions.