vDefend Turbo IDPS(SCRX) environment exhibits high latency under low‑throughput conditions

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

vDefend Turbo IDPS environments exhibit unexpectedly high packet latency when overall traffic volume is low. The problem does not appear under normal or high load.

Symptoms:

• Increase packet processing latency during low traffic conditions.
• Latency not observed at moderate or high throughput levels.
• Increased frequency of CPU wake-up events during idle periods.
• Interrupt patterns indicating frequent transitions from idle to active states

Validation / How to Observe Interrupt Behavior

Step 1: Identify the Infravisor vNIC

[root@ESXi:~] net-stats -l | grep infravisor
67109069 5 9 DvsPortset-0 00:0c:29:2b:84:f2 infravisor-pod.eth0

 

Step 2: Access vsish

[root@ESXi:~] vsish

 

Step 3: View vmxnet3 Interrupt Summary

/> cat /net/portsets/DvsPortset-0/ports/67109069/vmxnet3/intrSummary
Example Output:
intr stats of a vmxnet3 vNIC {
autoMask:1
intrType:3
intr stats:stats of the individual intr {
actions posted:287772        << Non-zero values are normal; a rapid exponential increase indicates an issue.
actions posted with hint:0
actions avoided:13547832
}
}

Environment

• Deployment Type: Turbo (SCRX) deployments only
• NSX Versions Affected:
  • NSX 4.2.2.x
  • NSX 4.2.3.1
  • NSX 4.2.3.2

Cause

The SCRX engine operates in a hybrid mode, combining interrupt‑based and poll‑based packet processing.

Hybrid Processing Behavior
When packets are present in the receive queue, they are processed immediately.
When no packets are present, commonly during low‑throughput scenarios, the CPU transitions to an idle state to conserve resources.

The CPU wakes up when:

• A new packet arrives, or
• The idle timer expires.

Each wake‑up introduces a small delay. Under low-traffic conditions, the CPU enters the idle state more frequently, resulting in more wake‑ups and higher cumulative latency.

Under moderate to high throughput, the CPU remains active due to continuous packet arrival, minimizing idle transitions and associated latency.

Resolution

The SCRX logic has been optimized to improve behavior under low‑throughput conditions in NSX 4.2.3.3 and later