The traffic from Guest Introspection USVM to Google Public DNS

Products

• VMware NSX

Issue/Introduction

• Observed traffic from Guest Introspection USVM to Google Public DNS (8.8.8.8, 8.8.4.4).
• Running NSX Guest Introspection 6.4.0, 6.3.6 or later.

Environment

VMware NSX for vSphere 6.4.x
VMware NSX for vSphere 6.3.x

Cause

The operating system in USVM was changed from NSX Guest Introspection 6.4 and 6.3.6 to Photon OS. Due to the system changes, USVM lookups Google Public DNS (8.8.8.8, 8.8.4.4) by default if Guest Introspection is deployed with IP pool. Therefore, traffic from USVM to Google Public DNS is observed when it tries to reverse lookup the assigned IP address in the boot sequence.

Note the traffic is only observed at the USVM first boot if the IP pool with the other DNS server's configuration is used. Because the reverse lookup runs before the DNS configuration change, USVM lookups the default DNS server only in the first boot sequence and lookups other DNS servers from the next boot sequence.

Resolution

This is an expected behavior. Guest Introspection is functional even if DNS is unreachable from USVM.