Diagnosing Network Issues on ESXi with esxtop and Log Files

In this blog, we will walk through how to diagnose and fix network issues on ESXi hosts, focusing especially on CRC errors and packet drops. We’ll cover using tools like esxtop, esxcli, and log files to get to the root of the problem — all with practical steps you can follow today.

Using esxtop to Identify Network Issues

Let’s start with what most seasoned admins reach for first: esxtop.

  1. SSH into the ESXi host
  2. Launch esxtop:esxtop
  3. Press n to jump into network view
ColumnWhat It Tells You
PKTTX/s, MbTX/s, PSZTXPackets sent, bandwidth, avg packet size
PKTRX/s, MbRX/s, PSZRXSame, but for incoming traffic
DRPTX, DRPRXDropped packets – zero is the goal

Hit f in esxtop and enable:

  • f: TEAM-PNIC
  • j: USED-BY (who’s using the interface?)
  • k: PORT-ID
  • n: VSWITCH
  • o: VLAN-ID

You’ll now be able to correlate exactly which VM or kernel port is responsible for traffic spikes or anomalies.


Detecting Saturation or Imbalance

If you’re hitting high throughput but things still feel sluggish, you might be saturating your link or not distributing load properly.

Saturation: Watch MbTX/s and MbRX/s. If you’re nearing 940 Mbps on a 1 Gbps NIC, you’re at the ceiling.

Imbalance: Using NIC teaming? Make sure the TEAM-PNIC column isn’t showing one uplink doing all the work while others sit idle. Load-based teaming helps here.


Deep Dive: NIC-Level Stats with esxcli

Sometimes the issue lies deeper than what esxtop reveals. Try:

esxcli network nic stats get -n vmnic7

Check for:

  • Transmit errors
  • Receive drops
  • CRC or framing errors (indicates cabling or physical port issues)

Logs are your silent witnesses. Here’s where to look:

Log FilePathWhat to Look For
vmkernel.log/var/log/vmkernel.logPacket drops, link state changes
vobd.log/var/log/vobd.logNIC up/down events
hostd.log/var/log/hostd.logSwitch config changes, VM attach events
syslog.log/var/log/syslog.logGeneral networking/system events

Use grep to pull highlights:

grep -i 'drop\|error\|vmnic\|link' /var/log/vmkernel.log
grep -i 'link.*up\|link.*down' /var/log/vobd.log

for crc errors, bad packets, usually physical or config related.
grep -i 'crc\|error\|link' /var/log/vmkernel.log
  • Confirming errors on NIC and switch
  • Matching duplex/speed mismatches
  • Replacing cables
  • Avoiding interference
  • Updating firmware
  • Checking logs for additional clues

Tail logs in real time while recreating the issue:

tail -f /var/log/vmkernel.log

Find VM-ID on ESXi to locate the vm causing issues

esxcli vm process list
or 
vim-cmd vmsvc/getallvms | grep <vmid>

(Visited 20 times, 1 visits today)

By Ash Thomas

Ash Thomas is a seasoned IT professional with extensive experience as a technical expert, complemented by a keen interest in blockchain technology.