Enormous WAN upload by ESXi?

[mensa84]

Hello,

I recognized on my router, that the IP address of my ESXi did upload an enourmous amount of data in the last days to WAN. Always about 30 - 60 GB. But I don't know to which destination and why.

What could that be?

All the VMs have there own IP addresses and therefore their own traffic.

What the hell my ESXi is doing there?

The last 24 hours WAN traffic of the IP address of my ESXi on my router:

[malickware]

You can start with doing a packet capture on the VC against one of the esxi host and see how many packets are coming in and also check for any re-transmission as well.