Skip to main content
Version: 2.9.1

Top VM:Host Pairs (10164 / 20164)


This Module reports top network conversations in VM environment. A network conversion is a series of data exchanges between two VM:Hosts (VM source IP:Host source IP and VM destination IP:Host destination IP), over the same protocol (TCP or UDP), and going through the same vSphere Distributed switch (VDS) (VxLAN ID). The number of exchanged bytes and packets are summed up.

The Module determines which VM:Host is a client and which is a server as follows: a server sends more traffic (bytes) than a client.


Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
N - number of reported host:vm pairsThe number of top hosts reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all hosts are reported)


VMware IPv4 VXLAN Template.

Syslog/JSON Message Fieldsā€‹

KeyField DescriptionComments
nfc_idMessage type identifier"nfc_id=200164"
exp_ipNetFlow exporter IP address<IPv4_address>
vxlanIdVxLAN ID<number>
sourceIPv4AddressSource host IPv4 address<IPv4_address>
destinationIPv4AddressDestination host IPv4 address<IPv4_address>
packetDeltaCount_inPackets from client to server<number>
octetDeltaCount_inLayer 3 bytes from client to server<number>
packetDeltaCount_outPackets from server to client<number>
octetDeltaCount_outLayer 3 bytes from server to client<number>
packetDeltaCountTotal Packets in the flow received by the input interface<number>
octetDeltaCountTotal number of Layer 3 bytes in the packets of the flow received by the input interface<number>
tenantSourceIPv4Source VM IPv4 address<IPv4_address>
tenantDestIPv4Destination VM IPv4 address<IPv4_address>
vm_adjacencyVM adjacency indicator. If equal ā€œYā€, VMs are residing on the same host.<string> ā€œYā€ or ā€œNā€
flow_countNumber of Flows<number>
percent_of_totalPercent of Total (bytes) VXLAN traffic<decimal>
t_intObservation time interval, msec<number>