Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Network timeouts or packet drops with VMware Tools 11.x with Guest Introspection Driver (79185)

Last Updated: 10/25/2022Categories: Known IssueTotal Views: 14309Language:
Chinese (Simplified)JapaneseEnglish

37 like this article

Subscribe to get an email
newsletter with new updates

37 people found this helpful Please provide article feedback:

Symptoms

Virtual Machine is using VMware Tools 11.x with Network Introspection driver (vnetWFP.sys) installed.

Users might experience packet loss (more than 1%) or other loss of network performance.

ICMP connectivity tests (e.g. ping) are reporting timeouts.

If debug logs are enabled for vnetWFP, (Please refer KB:2073078  for enabling debug logs), you may see following entries in either debug viewer or vmware.log (depending on configuration)

DEBUG: ALEInspectInjectComplete : Packet injection status is : c000021b

Cause

Packet drop is seen due to intermittent failure reported by the Microsoft WFP packet injection API.

Impact / Risks

NSX customers (especially those using IDFW and NSX-Intelligence features) and have done complete installation of VMTools 11.0.0+ on Windows endpoints may face this issue.

NSX Agentless Antivirus uses File Introspection driver (vsepflt). NSX Identity Firewall, NSX Intelligence use Network Introspection driver (vnetWFP). This issue only concerns the NSX Network Introspection driver(vnetWFP).

The severity of the issue has been reduced (by a third in test environment) in VMTools 11.1.5 by introducing retry logic. (Note this is not a fix nor a workaround)

Resolution

Upgrade to VMTools 12+

Workaround

Until the issue is fixed,  with VMTools 11.2.6, following registry setting can be used to disable the ICMP/UDP protocol support for the GI :

1) Click Start > Run, type regedit, and click OK. The Registry Editor window opens.

2) Create the following key using the registry editor:

HKEY_LOCAL_Machine\SYSTEM\CurrentControlSet\services\vnetwfp\parameters

3) Create the following DWORD value under the newly created parameters key:

Note: Ensure that Hexadecimal is selected when putting in these values. The ‘0x’ means hexadecimal, you should not enter ‘0x’ while adding the values in the registry. Selecting hexadecimal is enough.

Name: ksam_otorp

Type: DWORD

Possible Values for ksam_otorp:

0x400 - To disable filtering of ICMP messages

0x800 - To disable filtering of UDP messages

0x0 - To disable filtering of both ICMP and UDP messages

0xC00 - To enable filtering of ICMP and UDP messages

4) User can delete the key to get the default behavior (i.e. all protocols enabled). On VMTools 11.2.6, vnetWFP needs to be reloaded after deleting the registry.

Customer Use Case

Recommended Registry Setting

Comments

Non NSX customers who have installed GI File and Network Introspection drivers.

0x0

This use case does not require GI introspection drivers and may even uninstall both the file and network introspection component.

NSX customers not using IDFW or NSX-Intelligence feature and also not using third party AV powered by Guest Introspection.

0x0

This use case does not require GI introspection drivers and may even uninstall both the file and network introspection component.

NSX customers not using IDFW or NSX-Intelligence feature. But are using third party AV.

0x0

This use case requires only the file introspection component and does not require GI network introspection driver and may safely uninstall the network introspection component.

NSX customers using NSX IDFW functionality in NSX-V or NSX-T environment.

0x400

Result of setting this registry, we would not be enforcing IDFW rules configured for ICMP protocol.

NSX customers using NSX Intelligence feature in NSX-T environment.

0x400

There would be no significant impact on NSX Intelligence feature while setting this registry settings.

Please note:

By default without the registry setting all the protocol messages are supported in GI platform, nothing is disabled.

Disabling the above messages in the GI platform will impact the GI based networking features like NSX IDFW, NSX Intelligence. Registry only disables these protocol for the GI platform, general ICMP/UDP messages continue to work

______________________________________

you can also run the following in command prompt

sc query vnetwfp

to see the status of Guest Introspection Driver and

sc stop vnetwfp

to stop the service and if the timeouts cease Guest Introspection is the root

if the registry workaround does not work and Guest Introspection is not necessary on this VM you can rename the vnetwfp service in system32 with _old at the end and then kill the service using

sc stop vnetwfp

Related Information

The attached PR2470223-RCA.pdf contains preliminary investigation information about the cause of this issue.

Guest Introspection Network Driver (vnetWFP.sys) may fail to load (after reboot) when VMware Tools is upgraded while Windows defender is active
Windows VM with NSX Network Introspection driver lose TCP connectivity

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

PR2470223-RCA

Additional Resources

KB
•
Workspace ONE Content 3.22.1 for Android リリースのお知らせ (79224)

KB
•
VMware Intelligent Hub 20.04.1 for iOS リリースのお知らせ (79195)

KB
•
CRSVC-11528：「デバイス削除」などのデバイス管理操作が断続的に失敗する (79114)

KB
•
Workspace ONE SDK 20.4 for Android リリースのお知らせ (79124)

Results 1-4 of 4

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware vSphere ESXi

VMware Tools

Related Versions:

VMware vSphere ESXi 7.0.0

VMware vSphere ESXi 6.7

VMware vSphere ESXi 6.5

VMware Tools 11.x

VMware NSX-T Data Center 3.x

VMware NSX-T Data Center

Take Our Survey

Support Assistant