6.5.1

Table Of Contents
3 If you have not limited the number of packets by using the --count option, press Ctrl+C to stop
capturing or tracing packets.
What to do next
If the contents of the packet are saved to a file, copy the file from the ESXi host to the system that runs a
graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.
Using the Capture Points of the pktcap-uw Utility
You use the capture points of the pktcap-uw utility to monitor packets when a function handles them at a
specific place in the network stack on a host.
Overview of Capture Points
A capture point in the pktcap-uw utility represents a place in the path between a virtual switch on one
side and a physical adapter, VMkernel adapter or a virtual machine adapter on the other.
You can use certain capture points in combination with an adapter option. For example, you use the
UplinkRcv point when you capture uplink traffic. You can address other points standalone. For example,
use the Drop point to inspect all dropped packets.
Note Certain capture points of the pktcap-uw utility are designed for VMware internal use only and you
should use them only under the supervision of VMware Technical Support. These capture points are not
described in the vSphere Networking guide.
Option for Using Capture Points in the pktcap-uw Utility
To examine a packet state or content at a capture point, add the --capturecapture_point option to the
pktcap-uw utility.
Auto-Selecting a Capture Point
For traffic that is related to a physical, VMkernel or VMXNET3 adapter, by combining the --dir and
--stage options you can auto-select and switch between capture points to examine how a packet
changes before and after a point.
Capture Points of the pktcap-uw Utility
The pktcap-uw utility supports capture points that can be used only when you monitor uplink, VMkernel
or virtual machine traffic, and capture points that represent special places in the stack that are not related
to the adapter type.
Capture Points That Are Relevant to Physical Adapter Trac
The pktcap-uw --uplink vmnicX command supports capture points for functions that handle traffic at
a specific place and direction in the path between the physical adapter and the virtual switch.
Capture Point Description
UplinkRcv The function that receives packets from the physical adapter.
UplinkSnd The function that sends packets to the physical adapter.
vSphere Networking
VMware, Inc. 231