VMware Communities
Lippolt
Contributor
Contributor
‎10-20-2023 06:16 PM

High CPU usage by vmnat.exe after upgrade to VMware® Workstation 17 Pro version 17.5.0 build-2258379

I just upgraded to VMware® Workstation 17 Pro version 17.5.0 build-22583795. Since then my system has a high processor load due to the file vmnat.exe (version from 10.10.2023, digitally signed by VMware). One processor core is 100% utilized.

I did not find anything in this direction in the release notes. What can be done about this?

With best regards from Hannover Germany,
Peter Lippolt

Reply
32 Replies
jen2
Enthusiast
Enthusiast
‎10-21-2023 03:22 AM

It is a very aggressive bug I have already reported here https://communities.vmware.com/t5/Workstation-2023-Tech-Preview/BUG-VMware-NAT-Service-high-CPU-usag...

 

The only solution is to replace vmnat.exe in the C:\Windows\SysWOW64 with the old version 17.0.2. But you have to stop the service first (VMware NAT Service)

 

I will upload the file for anyone having this bug.

vmnat.zip
Reply
louyo
Virtuoso
Virtuoso
‎10-21-2023 03:31 AM

This was reported during the trial:

https://communities.vmware.com/t5/Workstation-2023-Tech-Preview/BUG-VMware-NAT-Service-high-CPU-usag...

His "fix" seems a little drastic. Hopefully, someone else has a better one. 

If you have support contract, you might want to contact them.

Reply
0 Kudos
jen2
Enthusiast
Enthusiast
‎10-21-2023 03:43 AM

That was me, and it was the same fix

Reply
0 Kudos
louyo
Virtuoso
Virtuoso
‎10-21-2023 04:06 AM

Sorry about that, I was typing while you were entering. Should have double checked.

Lou

Reply
0 Kudos
Maxvatar
Contributor
Contributor
‎10-21-2023 05:29 AM

Hi Peter,

same here. The only proper solution is to uninstall 17.5 and download "VMware-workstation-full-17.0.0-20800274.exe" from VM site ... it is still available there.

I wonder why VMWare release the 17.5 build when the high-cpu-usage bug of vmnat.exe is known from prerelease version, as Jen2 mentioned. It is rather weird in case of such software company as VMWare is.

Best regards

Tomas

Reply
0 Kudos
louyo
Virtuoso
Virtuoso
‎10-21-2023 07:54 AM

Voice of experience: The devs said fix it, the suits said ship it. 

Reply
merlingecko
Contributor
Contributor
‎10-21-2023 08:38 AM

same problem here :disappointed_face:

Reply
0 Kudos
seekay3309
Contributor
Contributor
‎10-21-2023 07:16 PM

Same problem.  I wish I knew about this bug beforehand.  I'll try to revert now.

Reply
0 Kudos
jen2
Enthusiast
Enthusiast
‎10-22-2023 01:52 AM

@Maxvatar wrote:

Hi Peter,

same here. The only proper solution is to uninstall 17.5 and download "VMware-workstation-full-17.0.0-20800274.exe" from VM site ... it is still available there.

I wonder why VMWare release the 17.5 build when the high-cpu-usage bug of vmnat.exe is known from prerelease version, as Jen2 mentioned. It is rather weird in case of such software company as VMWare is.

Best regards

Tomas

@seekay3309 wrote:

Same problem.  I wish I knew about this bug beforehand.  I'll try to revert now.

I would not recommend to revert unless you don't care of security! There are lots of CVE fixes.

The best way IMHO id you care about security is to replace only the vmnat.exe with old version I attached in post 2

 

Reply
0 Kudos
seekay3309
Contributor
Contributor
‎10-22-2023 08:52 AM

Sigh.  I already re-ran the 17.0 Installer, but it wouldn't downgrade 17.5 to 17.0.  I un-installed 17.5 and re-installed 17.0.  All settings (license keys, drive sharing, VMs) had to be put back.  I also had to restore a Windows VM from a week-old backup so I lost a few minor updates/changes (but nothing major).  Fortunately, I monitor my CPU utilization and background processes or I wouldn't have known.

The Installer I had this issue with is VMware-workstation-full-17.0.2-21581411.exe.  Hopefully a new Installer with the fix gets posted soon so others don't have this issue too.

And yes.  I am security conscious.  That's why right off I didn't install a .exe file posted on a forum.

Reply
0 Kudos
jen2
Enthusiast
Enthusiast
‎10-22-2023 10:00 AM

@seekay3309 wrote:

Sigh.  I already re-ran the 17.0 Installer, but it wouldn't downgrade 17.5 to 17.0.  I un-installed 17.5 and re-installed 17.0.  All settings (license keys, drive sharing, VMs) had to be put back.  I also had to restore a Windows VM from a week-old backup so I lost a few minor updates/changes (but nothing major).  Fortunately, I monitor my CPU utilization and background processes or I wouldn't have known.

The Installer I had this issue with is VMware-workstation-full-17.0.2-21581411.exe.  Hopefully a new Installer with the fix gets posted soon so others don't have this issue too.

And yes.  I am security conscious.  That's why right off I didn't install a .exe file posted on a forum.

It is the original file from VMWare 17.02 and it is signed by VMWare. The file is scanned by vmware before published, and you can check it using https://www.virustotal.com/gui/home/upload

Do you think I am so stupid to put a virus in the official VMWare forum? The file will be removed and I will be banned immediately

Reply
0 Kudos
Lippolt
Contributor
Contributor
‎10-22-2023 03:06 PM

The vmnat.exe posted by Enthusiast is code-signed by VMware. At least a strong sign for being OK. 

Reply
0 Kudos
visentet
Contributor
Contributor
‎10-25-2023 10:03 AM

Many thanks, I was already thinking about a downgrade of entiero VMware.

 

Reply
0 Kudos
Julio_Imdg
Contributor
Contributor
‎10-26-2023 09:15 PM

Same problem.

Using vmnat.exe 17.0.2. did not help!

Reply
0 Kudos
jen2
Enthusiast
Enthusiast
‎10-27-2023 04:25 AM

@Julio_Imdg wrote:

Same problem.

Using vmnat.exe 17.0.2. did not help!

Are you sure that you replaced the file in the C:\Windows\SysWOW64 folder?

Reply
0 Kudos
Lippolt
Contributor
Contributor
‎10-27-2023 04:38 AM

Hi Jen2,

I am sure I have modified the file in the following directory: C:\Windows\SysWOW64. I found the directory via Task Manager and the process with the high processor load. As you know, you can see the path to the executable under Details.
Replacing the file can only be done after successfully stopping the service in the Service Manager. Since I did this, I have no more problems. As soon as I copy the original file back from VMware Workstations pro 17.5, the problem reappears.

Greetings from Hanover, Germany,
Peter

Reply
0 Kudos
visentet
Contributor
Contributor
‎10-27-2023 04:51 AM

Hi Lippolt.

You don't have to copy the original, you have to leave the vmnat.exe from version 17.0.2. Start the service and work correctly.

Reply
0 Kudos
Julio_Imdg
Contributor
Contributor
‎10-27-2023 02:55 PM

Hi Jen2!

Sorry, I did a Mistake.
Before replacement, I found two copies of that file vmnat.exe. One located in C:\Program Files (x86)\VMware\VMware Workstation and  the other in C:\Windows\SysWOW64 . I thought.. I replaced both. However I just have doublechecked. For some reason the syswow64 still had the 17.5 version. So, I replaced that file for the 17.0.2 version.
I have been monitoring cpu usage (two hours) using two WIndows 10 guest VM. No vmnat issues showed so far.
 
Thanks
Reply
0 Kudos
erobrich
Contributor
Contributor
‎10-28-2023 11:35 AM

I hit this problem as well.  VMware NAT Service runs somewhere between 18 and 30% of my host's CPU all the time -- even when both guest and host are completely idle.  Additionally, guests lost DNS through NAT service, and I had to add manual DNS servers to all guests.  Host and guest are Win 11 22H2, fully patched.  I'd really rather not downgrade.  Hopefully 17.5.1 comes quickly and patches this?

Reply
0 Kudos