Duplicate flows reported in Aria Operations for Networks for NSX overlay segments

Products

• VMware NSX
• VCF Operations for Networks

Issue/Introduction

• Aria Operations for Networks is reporting duplicate Flows for VMs connected to NSX overlay segments
• VMs that don't match the source or destination IP/MAC of the flow are receiving unicast traffic not destined for it
• The traffic is originating from and destined for the same segment
• You do not have promiscuous mode enabled on a portgroup for bridging

Environment

VMware NSX
Aria Operations for Networks

Cause

The default number of MAC addresses learned on an overlay-backed segment is 2048. Exceeding the maximum MAC identifiers per VNI may lead to flooding and can impact packet performance.

Resolution

Keep below the 2048 MAC limit on an overlay segment to avoid traffic flooding. Either use a /21 or /22 subnet to stay below the limit.
To avoid packets being dropped, you can enable MAC learning and allow unknown unicast flooding on the segment profile. 

Check the ARP table of the segment to verify the amount of MAC addresses associated with a segment.

1. CLI as admin on a manager node:
 get segment <vni-or-uuid> arp-table

2. Download the ARP table as .csv file from the UI

Additional Information

From VMware Configuration Maximums:
MAC Identifiers per Overlay Segment (VNI) - Limit 2,048

Administration Guide - Segments