Host fails with a purple diagnostic screen when the Internet Protocol Flow Information Export is enabled

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Internet Protocol Flow Information Export (IPFIX) is a protocol that collects, aggregates, and exports IP traffic information. There is a limit to the number of exported network flow records per a vSphere Distributed Switch. When this limit is exceeded, the host fails with a purple diagnostic screen (PSOD) and an error message.

When there is a burst of flows, IPFIX might attempt to export a large number of flows that share the same transportation layer protocol, such as UDP,TCP, or ICMP, in one timer run, which is executed once per second. If the number of such flows reaches the limit of 65535 per second, a memory corruption issue occurs, because the allocated flow array is insufficient. Data is overwritten and becomes corrupted, and the host crashes.

Environment

VMware vSphere ESXi 6.5
VMware vCenter Server 6.5.x

Resolution

When you enable the multicast DNS service, multicast traffic to different ports is considered by IPFIX as different flows. So, when the number of virtual machines per host increases, the number of flows that IPFIX collects and exports also increases.

Multicast traffic is also generated when no DNS server is configured in the environment.

To prevent the host from failing with a purple diagnostic screen, use one of the following methods:

• Do not open IPFIX when you expect a burst of flows.
• Stop the Avahi mDNS/DNS-SD daemon when no DNS is configured in the environment, because the Avahi daemon sends out multicast traffic under those conditions.
• Deploy a DNS server instead of using an open multicast DNS service. If you do not want to use DNS, disable it in the virtual machines to avoid unnecessary multicast DNS traffic in the network.
• Decrease the IPFIX sampling rate.