Manually Changing the Packet Filter State in vCenter Heartbeat

In a working state of vCenter Heartbeat, the packet filter is the mechanism that exposes the public IP address on the Active vCenter Server and hides it on the Passive vCenter server. Using the nfpktfltr.exe getstate command, you can tell the state of the packet filter:

Active Server:


Passive Server:


I encountered a scenario wherein a split-brain was encountered in the environment. In a split-brain situation, both the primary and secondary vCenters think they are the “Active” server.  vCenter Heartbeat was able to detect split-brain and it effectively shutdown the Heartbeat service on the secondary node.

I performed the same command to check the packet filter status before bringing up the secondary vCenter’s heartbeat services but saw the state on the Secondary as “Passthru”, meaning it will be exposed in the network (analogous to being Active).

Digging around the nfpktfltr.exe command switches, there is an option to set the packet filter state. The command is nfpktfltr.exe setstate.


For the Secondary server I used nfpktfltr.exe setstate filter command to manually change the state and that did the trick.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s