6.5.1

c In the USED-BY column, locate the virtual machine adapter, and write down the PORT-ID value
for it.
The USED-BY field contains the name of the virtual machine and the port to which the virtual
machine adapter is connected.
d Press Q to exit esxtop.
2 In the ESXi Shell, run pktcap-uw --switchport port_ID.
port_ID is the ID that the esxtop utility displays for the virtual machine adapter in the PORT-ID
column.
3 In the ESXi Shell, run the pktcap-uw command with the --switchport port_ID argument and with
options to monitor packets at a particular point, filter captured packets and save the result to a file.
pktcap-uw --switchport port_ID [--capture capture_point|--dir 0|1 --stage 0|1] [filter_options]
[--outfile pcap_file_path [--ng]] [--count number_of_packets]
where the square brackets [] enclose the options of the pktcap-uw --switchport port_ID
command and the vertical bars | represent alternative values.
If you run the pktcap-uw --switchport port_ID command without options, you obtain the content
of packets that are incoming to the standard or distributed switch in the console output at the point
when they are switched.
a To check packets at another capture point or direction in the path between the guest operating
system and the virtual switch, use the --capture option or combine the values of the --dir and
--stage options.
pktcap-uw Command Options Goal
--capture Vmxnet3Tx
Monitor packets when they pass from the virtual machine to the switch.
--capture Vmxnet3Rx
Monitor packets when they arrive to the virtual machine.
--dir 1 --stage 0 Monitor packets immediately after they leave the virtual switch.
--dir 1
Monitor packets immediately before they enter the virtual machine.
--dir 0 --stage 1 Monitor packets immediately after they enter the virtual switch.
b Use a filter_options to filter packets according to source and destination address, VLAN ID,
VXLAN ID, Layer 3 protocol, and TCP port.
For example, to monitor packets from a source system that has IP address 192.168.25.113, use
the --srcip 192.168.25.113 filter option.
vSphere Networking
VMware, Inc. 226