Multiple Alerts "VM Network has dropped transmit packets" is triggering on different VM's in NSX environment

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Multiple alerts for "VM Network has dropped transmit packets" are triggered across various Virtual Machines within an NSX-T/NSX environment. Despite these alerts, no actual packet loss is observed in NSX logical switching or routing layers. Symptoms persist even after implementing workarounds from related KB articles (e.g., KB 393915).

Environment

VMware Aria Operations Version 8.18.5

Cause

The behavior is caused by the asynchronous nature of counter retrieval within the network stack and vSwitch modules. Because specific network modules do not track drops directly, the system aggregates multiple counters to calculate total drops. Since these counters cannot be read atomically, transient discrepancies occur during the polling interval, leading to false-positive reporting of packet drops, as per KB 

vCenter (VC) or vROps may incorrectly report small packet drops for a Distributed Virtual Switch (DVS) port, even when no actual packet drops occur.

Resolution

There is currently no permanent fix for this reporting behavior. A redesign of the drop-counting mechanism is planned for a future release. Customers should utilize the following guidance when monitoring Distributed Virtual Switch (DVS) port statistics:

1. Analyze Data Patterns: Examine the DVS port statistics graph rather than relying on point-in-time alerts.

2. Ignore Spikes: Disregard temporary, isolated spikes in the transmit drop count, as these represent the asynchronous counter mismatch.

3. Validate Sustained Drops: Only a constant, non-zero line or a sustained upward trend in the drop counter indicates genuine packet loss requiring investigation.

Additional Information

 

• KB 414976 - Network drop counters may report false positives

• KB 393915 - Guest OS reports packet drops on VMXNET3 adapter