6.7

Table Of Contents
What to do next
Copy the pcap and pcap.gz files to a system that runs a graphical analyzer tool, such as Wireshark, and
examine the packet details.
Capturing and Tracing Network Packets by Using the
pktcap-uw Utility
Monitor the traffic that flows through physical network adapters, VMkernel adapters, and virtual machines
adapters, and analyze packet information by using the graphical user interface of network analysis tools
such as Wireshark.
In vSphere you can monitor packets on a host by using the pktcap-uw console utility. You can use the
utility without additional installation on an ESXi host. pktcap-uw provides many points in the host network
stack at which you can monitor traffic.
For detailed analysis of captured packets, you can save packet content from the pktcap-uw utility to files
in PCAP or PCAPNG format and open them in Wireshark. You can also troubleshoot dropped packets
and trace a packet's path in the network stack.
Note The pktcap-uw utility is not fully supported for backward compatibility across vSphere releases.
The options of the utility might change in the future.
pktcap-uw Command Syntax for Capturing Packets
Use the pktcap-uw utility to inspect the contents of packets while they traverse the network stack on an
ESXi host.
pktcap-uw Syntax for Capturing Packets
The pktcap-uw command has the following syntax for capturing packets at a certain place in the network
stack:
pktcap-uw switch_port_arguments capture_point_options filter_options output_control_options
Note Certain options of the pktcap-uw utility are designed for VMware internal use only and you should
use them only under the supervision of VMware Technical Support. These options are not described in
the vSphere Networking guide.
vSphere Networking
VMware, Inc. 207