VMware ESXi and vSphere Cluster Management

Monitor Network Performance with vCenter Server Performance Charts

Learn how to use vCenter Server performance charts to monitor ESXi host and VM receive rate, transmit rate, and network usage in real time and historically.

vCenter Server performance charts help administrators see how much network traffic an ESXi host or virtual machine is receiving and transmitting. These charts are useful for troubleshooting unexpected activity, validating workload behavior, and building a baseline of normal network use.

This lesson shows how to configure an advanced network performance chart, interpret receive rate, transmit rate, and usage, and correlate chart results with other evidence. The charts report performance counters; they do not replace detailed network diagnostics.

What Network Performance Monitoring Shows

vCenter Server is the vSphere management platform used to inventory ESXi hosts and VMs and view collected performance statistics. A performance chart is a visualization of those metrics across a selected time interval.

Network charts provide visibility into traffic generated or received by the selected object. Common reasons to inspect them include:

Validating the expected traffic level of a workload.
Investigating unusually high inbound or outbound activity.
Determining whether traffic is isolated to one VM or affects an entire ESXi host.
Establishing normal ranges and recurring peak periods for capacity planning.
Checking whether a suspected backup, replication, migration, or application event corresponds with a traffic increase.

Traffic volume and transfer rate are not the same as end-to-end network quality. A chart can show how much data is moving, but it does not by itself show latency, packet loss, jitter, cabling faults, switch-port errors, firewall behavior, or application protocol problems. Treat chart values as evidence about activity, then correlate them with guest, ESXi, and physical-network observations.

Supported Inventory Objects

Network performance counters can be viewed for an individual ESXi host or virtual machine (VM). An ESXi host is the physical virtualization server whose networking activity can be monitored. A VM is a guest workload whose associated network activity can be monitored.

Inventory Object	Network Counters Available	Monitoring Use Case
Virtual machine	Yes, for the selected VM	Determine whether one workload has inbound, outbound, or bidirectional activity.
ESXi host	Yes, for the selected host	View aggregate host networking activity and compare activity across workloads.
Datacenter	Not as direct network chart metrics	Use the individual hosts or VMs contained in the datacenter.
Cluster	Not as direct network chart metrics	Inspect its individual hosts and VMs.
Resource pool	Not as direct network chart metrics	Inspect the individual VMs or hosts associated with the workloads.

A host-level chart represents networking activity for the selected host. A VM-level chart represents traffic associated with the selected VM. The two views answer different questions and should often be compared.

Open the Advanced Performance Charts

Select the relevant ESXi host or VM in the vCenter inventory.
Open Monitor.
Open Performance.
Open the Advanced performance-chart view.
Open Chart Options to choose the metric group, object, counters, time range, and chart format.

Exact labels can vary slightly among vSphere Client versions, but the workflow is generally the same: select an object, open its performance view, and configure the advanced chart.

Configure a Real-Time Network Chart

Use a real-time chart when you need to observe current or very recent activity during an investigation.

In Chart Options, choose Network as the metric group.
Set the time span to Real-time.
Choose Line Graph as the chart format. A line graph makes changes and peaks easier to see over time.
Choose the selected ESXi host or VM as the chart object.
Add Data receive rate, Data transmit rate, and Usage.
Apply the selections.
Confirm that the chart renders the selected series and that the legend and units are visible.

Before interpreting a value, check the displayed unit and the metric's rollup behavior. A rate may be displayed in a bit-based or byte-based unit, and a chart may summarize samples differently depending on the selected time range. Do not compare values until you know what the units represent and how the samples were aggregated.

Understand the Network Counters

Counter	Traffic Direction or Meaning	Typical Use	Interpretation Notes
Data receive rate	Inbound network data received by the selected host or VM context.	Identify downloads, incoming requests, replication input, or other inbound workload activity.	A peak indicates increased inbound transfer during the sampled interval; confirm the unit and rollup before comparing it with another chart.
Data transmit rate	Outbound network data sent by the selected host or VM context.	Identify uploads, outgoing responses, backups, replication output, or other outbound activity.	A high value can guide investigation of an outbound transfer, but it does not prove the cause or indicate a fault by itself.
Usage	The reported utilization level for the monitored network context.	Identify sustained or unusually high use relative to the object's capacity and normal baseline.	Correlate with adapter capacity, workload behavior, and other network evidence before declaring congestion.

Receive rate and transmit rate describe transfer direction over time. Usage describes the reported utilization for the selected object and chart context. Simultaneous receive and transmit activity can indicate bidirectional workload traffic, such as an application serving requests, a replication stream, or a data-processing service.

Sustained elevated usage deserves investigation, but a high chart value is not automatically network saturation. Compare it with the relevant adapter capacity, the normal workload pattern, and physical switch or adapter telemetry. Also consider whether the traffic is expected, such as during a scheduled backup or migration.

Real-Time and Historical Statistics

Characteristic	Real-time	Historical
Primary purpose	Observe current or near-current activity.	Analyze patterns across a longer period.
Typical investigation type	Watch a live incident, reproduce a symptom, or confirm current traffic.	Find recurring peaks, compare healthy and incident periods, and support capacity planning.
Time coverage	A short recent window.	Earlier hours, days, or other retained intervals, depending on available statistics.
Dependence on retention settings	Uses recent collected samples.	Strongly depends on vCenter statistics collection, granularity, and retention settings.

Real-time charts are appropriate when a problem is happening now or can be reproduced. Historical views are better for recurring peaks, trend analysis, and capacity planning. Available history and detail depend on vCenter statistics collection and retention configuration. Older data may be unavailable, or it may be retained only at a coarser granularity.

When historical detail is insufficient, monitor the next occurrence in real time, review vCenter statistics settings, or use an external monitoring system for longer-term and more detailed network telemetry. The same time-series approach applies to related performance areas, such as disk-usage monitoring and broader performance-statistics analysis.

A Repeatable Monitoring Workflow

Start with the affected VM. If one workload is reported as slow or unusually active, select that VM and inspect real-time receive rate, transmit rate, and usage.
Identify traffic direction. Compare receive and transmit patterns to determine whether activity is primarily inbound, outbound, or bidirectional.
Compare with the parent host. Open the network chart for the ESXi host running the VM and examine the same incident window.
Check whether the activity is isolated. If the host is busy but the VM is not the main contributor, inspect other workloads and scheduled operations.
Compare time periods. Compare the incident window with a known healthy period using the same object, counters, units, and suitable time range.
Correlate the result. Check workload logs, backup or replication schedules, guest measurements, ESXi network configuration, physical switch monitoring, and adapter-level evidence.
Record the investigation. Write down the timestamp, selected object, time range, displayed units, selected counters, and observed peaks.

Recording these details makes the investigation repeatable. It also prevents a later comparison from mixing VM-level values with host-level values or rate units with utilization percentages.

Practical Example: Investigate High Activity on One VM

Select the reported VM in vCenter.
Open Monitor > Performance > Advanced.
Open Chart Options, choose Network, select Real-time, and choose a line graph.
Add data receive rate, data transmit rate, and usage for the VM.
Observe whether the activity is mainly inbound, outbound, or bidirectional.
Open the parent ESXi host's network chart for the same time period.
Determine whether the host shows similar activity from multiple workloads.
Check whether the peak matches a backup, replication, migration, or application event.

This separates a VM-specific traffic pattern from broader host-level activity. The chart guides the next diagnostic step; it does not, by itself, identify the application or network fault.

Practical Example: Establish an ESXi Host Baseline

Select the ESXi host.
Configure a Network line chart with receive rate, transmit rate, and usage.
Collect readings during normal business activity.
Review retained historical data for daily or weekly peaks when available.
Document typical ranges, normal peak periods, and unusual deviations.

A baseline helps distinguish expected scheduled traffic from an abnormal event. It should be revisited after major workload, capacity, or network-configuration changes.

Practical Example: Validate a Suspected Outbound Transfer

Set the chart to the relevant real-time or historical interval.
Compare transmit rate with receive rate.
Check whether the outbound peak corresponds with backup, replication, migration, or application activity.
Use infrastructure and workload logs to confirm what generated the transfer.

A transmit-rate peak can guide investigation of an outbound event, but it is not definitive proof of a security incident or a particular application cause.

Troubleshooting Chart Problems

The Network Category or Counters Are Unavailable

Possible causes include selecting a datacenter, cluster, or resource pool instead of an individual host or VM, remaining outside the advanced chart configuration view, or lacking sufficient permissions.

Select an individual ESXi host or VM.
Open the Advanced performance charts and review the available Network counters.
Verify that the account has sufficient vCenter visibility and permissions.

No Meaningful Data Appears in Real Time

The workload may be idle, the observation window may not contain the reported event, or the wrong object or counter may be selected.

Confirm the selected host or VM.
Wait for or generate known workload activity where appropriate.
Check both receive and transmit counters.
Use a suitable historical interval when analyzing an earlier event.

Usage Is High on an ESXi Host

One or more VMs may be producing substantial traffic. Backup, replication, migration, or other network-dependent operations may also be active. Sustained high demand is another possibility.

Review VM-level charts to identify major contributors.
Compare the observation with normal baseline values.
Correlate the peak with scheduled jobs and operational events.
Check physical network and adapter-level monitoring before concluding that network saturation is the cause.

Historical Information Is Missing or Too Coarse

The period may be outside the retained statistics window, the selected historical interval may not support the desired granularity, or vCenter collection and retention settings may not preserve the required detail.

Use real-time monitoring during the next occurrence.
Review vCenter performance-statistics collection and retention policies.
Use external monitoring for longer-term or more detailed network telemetry when necessary.

Scope and Limitations

vCenter performance charts report counters collected for inventory objects. They do not replace packet captures, guest operating-system measurements, physical switch telemetry, or detailed application diagnostics.

Performance charts alone cannot identify switch-port faults, cabling issues, packet-loss sources, firewall behavior, or application protocol causes. If the chart shows an unexpected pattern, correlate it with:

Physical switch port counters, errors, drops, and interface utilization.
VM guest network measurements and application logs.
ESXi network configuration, VMkernel adapters, virtual switches, port groups, and physical NIC status.
Backup, replication, migration, and other scheduled operations.

Key Terms

vCenter Server: The vSphere management platform used to inventory hosts and VMs and view performance statistics.
ESXi host: The physical virtualization host whose aggregate network activity can be monitored.
Virtual machine (VM): A guest workload for which network performance counters can be viewed.
Performance chart: A vCenter visualization of collected performance metrics over a selected time interval.
Advanced performance view: The chart interface for selecting metric categories, counters, objects, time spans, and chart styles.
Network metric group: The performance category containing network-related counters.
Data receive rate: The rate of inbound network data received by the selected host or VM context.
Data transmit rate: The rate of outbound network data sent by the selected host or VM context.
Usage: A reported measure of network utilization for the selected object and chart context.
Real-time statistics: Recent performance data used to observe active or near-current behavior.
Historical statistics: Previously collected performance data used for analysis across longer periods.
Line graph: A chart format suited to showing changes in metric values over time.