[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More


VMware ESX Beacon Probing Explained

Published on
14,859 Points
3 Endorsements
Last Modified:
Beacon probing is a configurable network failure detection mechanism used by ESX to identify downstream network failures. The purpose of this article is to explain some of the mystery and clarify a commonly misunderstood subject. The information in this article was gathered through direct observation and discussions with VMware.

As opposed to “Link Status Only,” beacon probing can identify a downstream failure. In the event that a failure does not cause a link-down event or if the link-down state is not forwarded to the ESX host, beacon probing can identify and compensate for network failure. Beacon probing works in conjunction with link status, and link-state-down will still trigger a failover if beacon probing is enabled.

Beacon probing identifies failures by sending out and listening for broadcast packets of a specific type. ESX 4.1 uses ethertype 0x8922, ESX 4.0 uses an 802.3 frame which is displayed in Wireshark as an LLC frame with “BCN (0xFF)” in the control field. ESX 3.5 uses an ethertype of 0x05ff. The probes contain the virtual MAC associated with the physical NIC and the name of the interface.

When virtual switch tagging is used, beacon probing sends one packet per host, per second, per in-use VLAN. Meaning the probes are sent down VLANs on which there are virtual machines (this includes the ESX service console). In the case of two interfaces, each interface will send one probe every other second. A failure is identified if 3 consecutive packets are not received on an uplink. Therefore a total of 6 seconds will pass before an uplink is identified as down. As a side note, the maximum number of probes and VLANs to probe can be configured via vCenter under Software¿advanced settings¿net on the host configuration tab.

The number of packets can be alarming, especially in a large domain with many ESX hosts and multiple VLANs per host. For example, a single host with 2 physical interfaces and 3 VLANs will send 3 packets per second, 180 per minute, and 10,800 per hour. This can quickly add up in a farm domain with several hundred hosts.

VMware recommends using beacon probing for configurations with three or more network interfaces. Three or more interfaces allow ESX to identify the leg that is down. When using only 2 interfaces, beacon probing cannot pinpoint the outage. When a failure occurs in this scenario, ESX will enter “shotgun” mode and send all traffic down both legs.

I hope that this will help dispense with some of the conjecture and mystery surrounding beacon probing. I have not had the opportunity to its behavior with VGT configured, but I expect similar results.

Featured Post

Become a CompTIA Certified Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

Teach the user how to convert virtaul disk file formats and how to rename virtual machine files on datastores. Open vSphere Web Client: Review VM disk settings: Migrate VM to new datastore with a thick provisioned (lazy zeroed) disk format: Rename a…
This Micro Tutorial steps you through the configuration steps to configure your ESXi host Management Network settings and test the management network, ensure the host is recognized by the DNS Server, configure a new password, and the troubleshooting…

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month