Network traffic loss for VMs on a specific port group when port mirroring is enabled

Products

• VMware vCenter Server

Issue/Introduction

When port mirroring is enabled on a vSphere Distributed Switch (vDS), virtual machines (VMs) on the same port group or ESXi host may experience intermittent or complete network connectivity loss. This article explains the underlying loop prevention mechanism in vDS and provides steps to restore connectivity while maintaining traffic mirroring.

Environment

vSphere Distributed Switch (vDS)
ESXi 7.x, 8.x
VMware vCenter Server

Cause

By default, the vSphere Distributed Switch designates a destination port for mirroring as a "receive-only" interface to prevent network loops. If "Normal I/O on destination ports" is set to "Disallowed," the vDS kernel drops all inbound and outbound production traffic (including ARP, ICMP, and standard application traffic) for that destination port, causing the VM to lose network connectivity.

Resolution

To resolve this connectivity loss while retaining the port mirroring session, adjust the configuration to allow production traffic on the destination port, or implement a secondary vNIC for isolation.

1. In the vSphere Client, navigate to the Networking inventory.
2. Select the relevant Distributed Switch.
3. Navigate to the Configure tab and select Port Mirroring.
4. Select the active session and click Edit.
5. In the Advanced properties section, locate the Normal I/O on destination ports setting.
6. Change the value from Disallowed to Allowed.
7. Click OK to apply the changes.

Note: If strict traffic isolation is required, consider adding a secondary vNIC to the destination VM:

• Use the first vNIC for production traffic.
• Use the second vNIC exclusively for receiving the mirrored traffic stream.

If the issue persists, review the ESXi logs to confirm the port status. For instructions on how to retrieve these logs, refer to: How to collect diagnostic information for ESXi hosts.

Additional Information

If you require further assistance or need to speak with a Support Engineer, visit Contact Broadcom Support.