6.5.1

Procedure
1 (Optional) Find the name of the physical adapter that you want to monitor in the host adapter list.
n
In the vSphere Web Client, on the Configure tab for the host, expand Networking and select
Physical adapters.
n
In the ESXi Shell to the host, to view a list of the physical adapters and examine their state, run
the following ESXCLI command:
esxcli network nic list
Each physical adapter is represented as vmnicX. X is the number that ESXi assigned to the physical
adapter port.
2 In the ESXi Shell to the host, run the pktcap-uw command with the --uplink vmnicX argument and
with options to monitor packets at a particular point, filter captured packets and save the result to a
file.
pktcap-uw --uplink vmnicX [--capture capture_point|--dir 0|1] [filter_options] [--outfile
pcap_file_path [--ng]] [--count number_of_packets]
where the square brackets [] enclose the options of the pktcap-uw --uplink vmnicX command
and the vertical bars | represent alternative values.
If you run the pktcap-uw --uplink vmnicX command without options, you obtain the content of
packets that are incoming to the standard or distributed switch in the console output at the point
where they are switched.
a Use the --capture option to check packets at another capture point or the --dir option at
another traffic direction.
pktcap-uw Command Option Goal
--capture UplinkSnd
Monitor packets immediately before they enter the physical adapter device.
--capture UplinkRcv
Monitor packets immediately after they are received in the network stack from
the physical adapter.
--dir 1
Monitor packets that leave the virtual switch.
--dir 0
Monitor packets that enter the virtual switch.
b Use a filter_options to filter packets according to source and destination address, VLAN ID,
VXLAN ID, Layer 3 protocol, and TCP port.
For example, to monitor packets from a source system that has IP address 192.168.25.113, use
the --srcip 192.168.25.113 filter option.
vSphere Networking
VMware, Inc. 224