Multicast address is flooded among all ports when VMs placed under single ESXi host.

Products

VMware vSphere ESXi

Issue/Introduction

When VMs that use multicast application is placed under same ESXi host, it receives the non intended IGMP group data of it's neighbor VM.
When IGMP snooping is enabled the dVswitch is suppose to maintain the IGMP report and forward the data to VM only if "IGMP group join request" is requested, however in this case multicast traffic was being flooded like broadcast traffic.
IGMP group 1 receives traffic of IGMP group 2 and vice versa.
The guest VM has set a "ALLMULTI' flag explicitly.

/net/portsets/DvsPortset-0/ports/67108954/> get status
port {
port index:90
vnic index:0x00000001
portCfg:
dvPortId:5
clientName:vm_name.eth1
clientType: 5 -> VMM Virtual NIC
clientSubType: 9 -> Vmxnet3 Client
world leader:3161379
flags: 0x40093 -> IN_USE ENABLED WORLD_ASSOC DVS_PORT CONNECTED
Impl customized blocked flags:0x00000000
Passthru status: 0x8 -> DISABLED_BY_HOST
fixed Hw Id:00:50:56:##:##:##:
ethFRP:frame routing {
requested:filter {
flags:0x0000000f
unicastAddr:00:50:56:##:##:##:
numMulticastAddresses:22
multicastAddresses:##:##:##:00:00:01,##:##:##:00:00:fb,##:##:##:40:15:91,##:##:##:40:23:4a,##:##:##:40:23:65,##:##:##:40:23:66,##:##:##:40:23:6b,##:##:##:40:23:6c,##:##:##:40:23:71,##:##:##:40:23:72,##:##:##:40:23:77,##:##:##:40:23:78,##:##:##:40:2f:5f,##:##:##:40:2f:6b,##:##:##:40:2f:77,##:##:##:40:2f:83,##:##:##:40:ff:02,##:##:##:40:ff:03,##:##:##:40:ff:04,##:##:##:00:00:01,##:##:##:00:00:fb,##:##:##:97:84:0f,
LADRF:[0]: 0x0
[1]: 0x0
}
accepted:filter {
flags:0x0000000f <================== The multicast accept flag has been set to AllMulti
unicastAddr:00:50:56:##:##:##:
numMulticastAddresses:22
multicastAddresses:##:##:##:00:00:01,##:##:##:00:00:fb,##:##:##:40:15:91,##:##:##:40:23:4a,##:##:##:40:23:65,##:##:##:40:23:66,##:##:##:40:23:6b,##:##:##:40:23:6c,##:##:##:40:23:71,##:##:##:40:23:72,##:##:##:40:23:77,##:##:##:40:23:78,##:##:##:40:2f:5f,##:##:##:40:2f:6b,##:##:##:40:2f:77,##:##:##:40:2f:83,##:##:##:40:ff:02,##:##:##:40:ff:03,##:##:##:40:ff:04,##:##:##:00:00:01,##:##:##:00:00:fb,##:##:##:97:84:0f,
LADRF:[0]: 0x0
[1]: 0x0
}
}
filter supported features: 0 -> NONE
filter properties: 0 -> NONE
rx mode: 0 -> INLINE
tune mode: 0 -> default
fastpath switch ID:0xffffffff
fastpath port ID:0xffffffff
}

Environment

VMware vSphere ESXi

Cause

The VMs were flooded by multicast traffic due to the Guest OS explicitly setting the multicast accept filter to "ALLMULTI"
The DVS port status for the affected VMs, reported the accepted:filter flag as 0x0000000f.
This hexadecimal value represents a bitwise inclusive OR of the following Ethernet filter flags (0x0001 | 0x0002 | 0x0004 | 0x0008).

0x000f = 0x0001 | 0x0002 | 0x0004 | 0x0008, where the bits represent the following filters:

ETH_FILTER_UNICAST = 0x0001, // pass unicast (directed) frames
ETH_FILTER_MULTICAST = 0x0002, // pass some multicast frames
ETH_FILTER_ALLMULTI = 0x0004, // pass *all* multicast frames
ETH_FILTER_BROADCAST = 0x0008, // pass broadcast frames
ETH_FILTER_PROMISC = 0x0010, // pass all frames (i.e. no filter)

The ESXi host identified 22 active multicast addresses associated with the VMs. This count remains below the default maximum limit of 32 multicast addresses.
Because this flag is set by the guest OS, the ESXi host has no control over the incoming traffic restrictions. The host operates as designed by honoring the guest request, resulting in the VM being flooded with multicast traffic.

Resolution

This is an expected behavior from dVswitch as Guest OS is requesting for "ALLMULTI."
The user has to debug within the guest and/or application to identify why this flag is being sent.
Ensure the virtual machine is using a VMXNET3 network interface card.

Additional Information

For more information regarding multicast behavior in ESXi hosts, please refer article: Understanding IP Multicast in ESXi/ESX