ESXi vmkwarning log is filled with Flow Cache Warnings related to TTL

Products

• VMware NSX

Issue/Introduction

• NSX version is 4.0.x or 4.1.x (less than 4.1.1)
• /var/run/log/vmkwarning.log is flooded with the similar log lines:

^{2022-12-13T20:27:28.708Z Wa(180) vmkwarning: cpu64:2098149)WARNING: FlowCache.fc: FC_ActionVDR:1419: [nsx@6876 comp="nsx-esx" errorCode="ESX6"]TTL 1 is not greater than VDR action data hops 1}

• There is no dataplane traffic impact observed for the VM traffic hosted on the ESXi host.

Environment

VMware NSX 4.0.x

Cause

• Decrementing TTL is expected logic in Layer-3 networking . When TTL is decremented to zero for a packet, then that packet gets dropped.
•  Sometimes applications also purposefully set packet with low TTL value.

Resolution

• These warnings does not have any impact on the data plane.
• From NSX 4.1.1, the process is optimized by replacing these logs with counters on flow-cache stats.

Command to check the stats:

nsxdp-cli fc stats get