Traceflow occasionally shows extra hops in the packet path

Products

• VMware NSX

Issue/Introduction

• After executing Traceflow, the following warning is observed:

Traceflow round has multiple physical received observations. Please check whether the underlay switch floods packets. Your hypervisor may be in nested environment.

• NSX Segment with MAC Learning, Unknown Unicast Flooding enable.
• VM is connected to a segment with MAC Learning and Unknown Unicast Flooding enabled.

Environment

VMware NSX 4.2.x

Cause

• When MAC learning is enabled, the system relies on packets in the datapath to learn the MAC address XX:XX:XX:XX:XX:XX in VNI zzzz on the uplink.
• The MAC entry ages out after 10 minutes if no traffic is received on the uplink with the source MAC XX:XX:XX:XX:XX:XX.
• When the MAC entry does not exist, traffic destined to XX:XX:XX:XX:XX:XX is flooded on all ports in the broadcast domain. This explains the behavior observed in traceflow with MAC learning.
• When MAC learning is disabled, traffic destined to XX:XX:XX:XX:XX:XX is unconditionally forwarded to the uplink because the MAC address does not exist locally on the source ESXi host.

Resolution

By default, the default segment security profile has MAC learning disabled. If you have a custom profile where it is running (or you want to ensure it is explicitly turned off), follow these steps:

1. Go to Networking > Segments > Segment Profiles.
2. Click the MAC Discovery tab.
3. Find the profile assigned to your segment. Click the three dots (...) next to it and select Edit.
4. Look for the MAC Learning toggle switch.
5. Ensure the switch is toggled to Disabled.
6. Click Save.

Quick Tip: If you want to completely guarantee that MAC learning is off without altering custom profile settings, you can change the dropdown on your segment back to the default-mac-discovery-profile, which has MAC learning permanently disabled by default.