When attempting to install or upgrade NSX VIBs on an ESXi host via SDDC Manager, NSX Manager, or vSphere Lifecycle Manager (vLCM), the process fails at the pre-check or installation stage.
Symptoms:
Host remains in a "Pre-check Failed" or "Incomplete" state in the NSX UI.
Error message: "Debug tools vprobe or vprobe based packet capture is currently running on host. Please disable packet capture or vprobe before upgrading"
The pktcap-uw process may appear in the process list but cannot be terminated using standard kill signals.
TCP 5.x
NSX-T / NSX 3.x, 4.x
ESXi 7.x, 8.x
The ESXi installation engine detects an active vprobe or pktcap-uw (packet capture) session. These tools attach filters to the network stack IOChain. Upgrading the NSX VIBs requires modifying these filters; if a capture is active, the modification could cause a kernel exception (PSOD). In some cases, the process may be a "zombie" process—where the tool has been closed but the kernel still holds the session handle.
Log in to the ESXi host via SSH as root.
Search for active capture processes: ps -cv | grep -E "pktcap-uw|vprobe"
If a PID is returned, attempt to stop it: kill -9 <PID>
If the command returns "No such process", the process is stale and requires a management agent reset.
Restarting the agents often clears the registration of stale debug sessions:
Place the host in Maintenance Mode (ensure VMs are evacuated).
Run the following commands: /etc/init.d/hostd restart /etc/init.d/vpxa restart
Wait 2 minutes for the agents to re-sync with vCenter/NSX Manager.
If the error remains after restarting agents, a hardware reset is required to clear the kernel memory:
Reboot the ESXi host.
Once the host is back online and out of Maintenance Mode, retry the NSX VIB installation/upgrade.