How to verify if a vmkernel is in use

Products

• VMware vSphere ESXi

Issue/Introduction

• An administrator observes a VMkernel adapter (e.g., vmk1, vmk2) configured on an ESXi host that does not have specific services (like vMotion, vSAN, or Management) enabled.
• An administrator is unsure why this vmkernel port was created or what it is used for.
• The administrator needs to confirm if any valid network traffic is passing through this adapter before attempting to modify or delete it.

 

Cause

VMkernel adapters may remain on a host after network reconfigurations, migrations, or automated deployments. Before removing these adapters to reclaim IP addresses or clean up the configuration, it is critical to verify that they are not actively transmitting or receiving data.

Resolution

1. 1. Check using esxtop if there is any network traffic coming through it:
      • Open vCenter UI and select the ESXi host in question from the inventory
      • Go to Configure -> VMkernel adapters. and check if there are any Enabled Services which may indicate that it is in use:
        
   2. Open SSH session to ESXi host and verify if there are any network traffic passing the vmk:
      1. Check esxtop is any network traffic coming through it:
         • Open SSH to ESXi host and type esxtop and then click on n for networking
         • locate vmk# in question and monitor if there is data in the stats. If the stats only display all zeroes all the time, this indicates that there is no network traffic passing through it:
           
      2. Perform a packet capture on vmkernel adapter:
         • Run the following command in ESXi cli to capture packets and display on the screen in readable format:  tcpdump-uw -i vmk# -ne
         • Example for vmk2:  tcpdump-uw -i vmk2 -ne
         • The packets wil be displayed on the screen for user to analyze the traffic.
         • Hit ctrl+c to stop the capture

Additional Information

Packet Captures in ESXi using tcpdump-uw