I have an esxi Host here with a vswicth configured – teamed and failover with 2 uplinks.
Now when i look with wireshark and disconnect one nic i found some RARP requests to internet addresses from the Host.
Anyone know what the HOST is doing here? – Notify Switches is deactivated…
Screenshot is attached.
I have the same question (0)
Hey, i’m not sure if i’m understanding correctly.
If you would like to run wireshark externally (from a pc or server outside the esxi host) you would have to enable promiscouos mode on the vSwitch. If that’s not acceptable for you you can use pktcap-uw VMware Knowledge Base on the esxi host which exports the output as .pcap
Hope that works
This RARP frames are always used to notify the switches when an interface go down so it can move all the MAC Address to another VMNIC. I know you said you unconfigured the Notify Switches setting but from where did you unconfigure it?
If you unconfigure it from a single portgroup that will not apply on the remaining portgroups and if you change it from the vSwitch level but you also override a portgroup manually in the past (For example for vMotion, iSCSI, etc) the Notify Switches setting will still be enabled there.
Here is a cool post from one of the guys of this community that explains very well the RARP behavior: The vSwitch “Notify Switches” setting – Rickard Nobel