“VXLAN gave us a fixed 8-byte header. GENEVE gave us dynamic Type-Length-Value (TLV) metadata options. That difference changed overlay networking forever.”

During our architecture reviews at IBM Cloud, we analyzed why VMware transitioned from VXLAN (in NSX-V) to GENEVE (Generic Network Virtualization Encapsulation) in NSX-T.

VXLAN vs. GENEVE Comparison

• VXLAN (UDP 4789): Fixed 8-byte header containing a 24-bit VNI (Virtual Network Identifier). Lacks extensible header space for custom metadata.
• GENEVE (UDP 6081): Variable-length header supporting custom TLV (Type-Length-Value) options. Enables hypervisors to attach security context, trace IDs, and telemetry directly into the packet header.

[!NOTE] GENEVE’s variable header allows NSX-T Distributed Firewalls to pass security tags and flow IDs between ESXi and KVM hosts without performing separate database lookups.

# # Inspecting GENEVE Outer Header via Wireshark / TShark
# tshark -i vmk10 -Y "geneve" -V
  Geneve Header:
    Version: 0
    Protocol Type: IPv4 (0x0800)
    Virtual Network Identifier (VNI): 10050
    Option Class: VMware (0x013c)
    Option Type: Security Context (0x01)

The Verdict

Key Takeaway

Extensibility Wins Over Fixed Formats.

Choose GENEVE for modern software-defined overlay architectures. Dynamic metadata fields enable advanced microsegmentation, distributed routing, and end-to-end flow tracing across cloud boundaries.