Before you look at "why" is it dropping you should take a look at "what" it's dropping. For this we can do a packet capture on the VEM and see what's being dropped. You might get some clues from this.
Here's how you'd do it.
1. On your VEM - we need the LTL (Local Target Logic) # of your VM's interface. These values are unique to each VEM (whereas vEth #'s are unique to the entire DVS). You can do this from the VEM CLI.
vemcmd show port
2. Once you have the LTL of your VM (VM LTL's start at 49 & increment), we'll setup a vempkt capture with the following commands from the VEM CLI.
vempkt stop
vempkt clear
vempkt capture drop ltl x (where X = your VM's LTL from step 1)
(wait for 15-30sec)
vempkt stop
vempkt display detail all (to view locally)
vempkt display detail all > /tmp/vempkt_capture_drop.cap (to export to a file)
3. If you view the capture from the console you'll see some details about the dropped packets such as the source LTL (which you can possibly trace back to the VM using Step 1), source/destination MAC address, VLAN etc. **Note LTL in the range of 30x are your uplinks - meaning this traffic is to/from a host outside this particular VEM - In this case, trace the MAC address to the source/destination.) Unfortunately this is the only way to view the capture - unless you send the .cap file to me and I can run it through a parser which will generate a wireshark-readable file (courtesy of Michael Petrinovic @ TAC). Once I parse the capture you can see if it's a particular protocol, destination etc...
You should look for patterns in the dropped packets. I've seen strange multicast applications send out funny traffic which the VEM will end up dropping. We'll need to see the packet contents to confirm.
Regards,
Robert
