Debugging vCenter and ESXi heartbeat communication is an essential troubleshooting task when ESXi hosts experience intermittent disconnections, appear as Not Responding, or lose communication with vCenter Server. Because the heartbeat mechanism is one of the primary methods used by vCenter to verify host availability, analyzing this traffic can quickly determine whether the problem is caused by network connectivity, packet loss, firewall rules, routing issues, or service failures.
In a healthy VMware environment, every ESXi host periodically sends heartbeat packets to the vCenter Server over UDP port 902. These heartbeat messages are transmitted every 10 seconds by the vpxa (vCenter Server Agent) service running on the ESXi host. On the vCenter Server, the vpxd service receives and processes these packets, confirming that the managed host is still reachable and operational.
The heartbeat exchange is independent of many other management operations and provides vCenter with a lightweight method of monitoring host health. If heartbeat packets stop arriving, vCenter assumes that communication with the ESXi host has been interrupted, even if the host itself is still running virtual machines normally. In many cases, the underlying cause is not an ESXi failure but rather a networking problem affecting the management interface.
By default, vCenter Server expects to receive heartbeat packets within a 60-second window. If no heartbeat is received during that period, the host is marked as Not Responding and may eventually transition to a Disconnected state. This condition can trigger alarms, interrupt management operations, and prevent administrative tasks such as vMotion, DRS, or host configuration changes until communication is restored.
Common symptoms of heartbeat communication problems include:
- ESXi hosts disconnecting from vCenter Server unexpectedly.
- ESXi hosts frequently transitioning between Connected and Not Responding states.
- Management tasks failing even though virtual machines continue running.
- Delayed or failed inventory updates in the vSphere Client.
- Events in vpxd.log indicating missed heartbeats or communication timeouts.
- Network errors, firewall restrictions, or packet loss affecting UDP port 902.
In this guide, you will learn how the ESXi heartbeat mechanism works, how to identify the correct Management VMkernel interface, and how to capture and analyze heartbeat traffic using tcpdump on both the ESXi host and the vCenter Server. These techniques allow you to verify whether heartbeat packets are being transmitted and received correctly, making it easier to isolate network-related communication problems between ESXi and vCenter.
Find the Management VMKernel
The ESXi host sends the UDP heartbeat package through the Management VMkernel.
So, the first thing here is to identify what VMKnerel ESXi is using for Management traffic.
Firstly, access the ESXi host by SSH and type the command below to see all VMKernels interfaces:
esxcli network ip interface ipv4 get
So, we have 3 VMkernels interfaces in this example. Now, we need to check what “Tag” is associated with each VMKernel interface. We can check it with the command below:
esxcli network ip interface tag get -i VMKERNEL
Where:
VMKERNEL = The VMKernel identifier, like vmk0, vmk1, etc
In our example, the Management interface is the vmk0.
The command below is a way to get all Tags automatically:
for i in $(esxcli network ip interface ipv4 get | sed 1,2d | awk -F" " '{print $1}'); do echo $i $(esxcli network ip interface tag get -i $i); done;
Analyzing the Heartbeat traffic on the ESXi host
Access the ESXi host by SSH and type the command below to see the UDP heartbeat packets from the ESXi host to the vCenter Server:
tcpdump-uw -i vmk0 port 902
Observe that each packet was sent every 10 seconds!
Analyzing the Heartbeat traffic on the vCenter Server
Access the vCenter Server by SSH and type the command below to see the UDP heartbeat packets from the ESXi host to the vCenter Server:
tcpdump -i eth0 src 192.168.200.13 and port 902 -nn -v
Where:
src 192.168..200.13 = IP address of source ESXi host
Observe that each packet was received every 10 seconds!
Note: If the heartbeat packet doesn’t receive by the vCenter Server, it can represent an issue with the network, firewall, or something like that. It is a good idea to review the network configurations to check if something may be disturbing this type of traffic.
If this behavior occurs with one ESXi host, for example, you can try to restart the vpxa service on this ESXi host and check if this action fixes the issue!
Additionally, I would like to share goods VMware’s KBs about this topic:
