For at least a year I’ve been plagued – ok, maybe that’s too strong of a word – annoyed by the fact that when running VMware Workstation (I’m using Workstation 9 in this case, but it also happened to me in version 8) my laptop “host” would show VMNAT.exe would randomly consume many cpu cycles for no obvious reason.
The usual fix for me is to open Task Manager and kill VMNAT.exe. This was a pretty good work around as it wouldn’t cause issues for the VM that was running – VMNAT.exe would respawn almost immediately and work properly for while.
Today, I had some time so I decided to put on my Mark Russinovich hat and open up Process Explorer (can be downloaded here) and see what was going on at a deeper level. Here’s what I found:
- First, VMNAT starts getting wacky – I have an 8 core system so 13% is pretty close to chewing up what amounts to a whole core.
2. Delving deeper with Process Explorer we can see two threads chewing up CPU cycles:
3. Since those two culprits are part of the VMNAT.exe cpu issue, I took a look at Task Manager once more to see the threads running:
4. I started to tinker with the Suspend/Resume feature of the threads – I’ll save you all the permutations, but basically suspending mswsock.dll calmed down vmnat.exe.
5. However, it also had another deleterious effect – it stopped the VM from communicating. I had a continuous ping going from the VM to the Laptop host to see the suspension of networking.
So at this point, I’m not sure how to proceed. VMNAT is calling MSWSOCK.dll and that’s where the issue begins. I’m not about to do any serious debugging as those days are behind me :>)
I’m figuring this is a Microsoft issue but can be swayed that it’s a VMware issue. I guess I’ll just keep my old trick of killing vmnat.exe and letting it respawn itself. I did find these articles but, unfortunately, they didn’t really help.
I also recognize that my post isn’t helping either – I guess I’m just adding some commentary to the issue. If anyone has any pointers or fixes, I’ll post it here!
In the meantime, if I have more time, I’ll open a ticket with VMware.