Windows VM sending excessive DNS queries for VMware-Plugin

Products

• VMware vSphere ESXi
• VMware vSphere Foundation

Issue/Introduction

• Windows client machines are observed sending an excessive volume of DNS queries to resolve the Fully Qualified Domain Name (FQDN) for the vmware-plugin. This behavior can lead to increased network traffic and unnecessary load on DNS servers.
• The issue is typically identified by observing DNS logs similar to the following:

Mar 6 16:02:59  named[527770]: queries: client <Win-VM-IP>#<SRC-Port> query: vmware-plugin.example.domain IN A + (<DNS Server>)

• There is no VMware related software installed nor a scheduled PowerCLI script running on the VM.

Environment

VMware vSphere Foundation

Cause

The application or plugin local to the Windows guest attempts to resolve the vmware-plugin hostname against the external DNS infrastructure rather than handling the request locally. If the FQDN is not found or is misconfigured in the environment's search suffix, the client repeatedly retries the resolution.

Resolution

To workaround this issue, you must redirect the DNS queries for the plugin to the local loopback address by modifying the Windows hosts file:

1. Navigate to and open the following file: C:\Windows\System32\drivers\etc\hosts.

2. Add the following entry to the bottom of the file:
   
   127.0.0.1 vmware-plugin

3. Save the file.

4. (Optional) Flush the DNS cache by running the following command in a Command Prompt: ipconfig /flushdns