Why are there a large number of open sockets on ESXi 4.1 opened with Virtual Server Protection?
If there is a large amount of virtual machine activity, for example a lot of powering on and off of protected virtual machines, the ESXi will leave a large number of sockets in a state where they will not be cleaned up. The sockets will show using esxcli network connection list on the ESXi server.
This only affects ESXi 4.1 and appears to be a problem with that particular release (and it's updates). In most cases a restart of management will correct the issues. Another alternative is to shut down and power on the Virtual Server Protection virtual machine (SVM).
If the above information does not resolve your issue, please contact IBM Security Systems Customer Support.