6.7

Table Of Contents
2 In the ESXi Shell to the host, run the pktcap-uw command with the --uplink vmnicX argument and
with options to monitor packets at a particular point, filter captured packets and save the result to a
file.
pktcap-uw --uplink vmnicX [--capture capture_point|--dir 0|1] [filter_options] [--outfile
pcap_file_path [--ng]] [--count number_of_packets]
where the square brackets [] enclose the options of the pktcap-uw --uplink vmnicX command
and the vertical bars | represent alternative values.
If you run the pktcap-uw --uplink vmnicX command without options, you obtain the content of
packets that are incoming to the standard or distributed switch in the console output at the point
where they are switched.
a Use the --capture option to check packets at another capture point or the --dir option at
another traffic direction.
pktcap-uw Command Option Goal
--capture UplinkSnd
Monitor packets immediately before they enter the physical adapter device.
--capture UplinkRcv
Monitor packets immediately after they are received in the network stack from
the physical adapter.
--dir 1
Monitor packets that leave the virtual switch.
--dir 0
Monitor packets that enter the virtual switch.
b Use a filter_options to filter packets according to source and destination address, VLAN ID,
VXLAN ID, Layer 3 protocol, and TCP port.
For example, to monitor packets from a source system that has IP address 192.168.25.113, use
the --srcip 192.168.25.113 filter option.
c Use options to save the contents of each packet or the contents of a limited number of packets to
a .pcap or .pcapng file.
n
To save packets to a .pcap file, use the --outfile option.
n
To save packets to a .pcapng file, use the --ng and --outfile options.
You can open the file in a network analyzer tool such as Wireshark.
By default, the pktcap-uw utility saves the packet files to the root folder of the ESXi file system.
d Use the--count option to monitor only a number of packets.
3 If you have not limited the number of packets by using the --count option, press Ctrl+C to stop
capturing or tracing packets.
vSphere Networking
VMware, Inc. 213