6.7

Table Of Contents
Example: Capture Packets That Are Received at vmnic0 from an IP Address 192.168.25.113
To capture the first 60 packets from a source system that is assigned the IP address 192.168.25.113 at
vmnic0 and save them to a file called vmnic0_rcv_srcip.pcap, run the following pktcap-uw command:
pktcap-uw --uplink vmnic0 --capture UplinkRcv --srcip 192.168.25.113 --outfile vmnic0_rcv_srcip.pcap
--count 60
What to do next
If the contents of the packet are saved to a file, copy the file from the ESXi host to the system that runs a
graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.
Capture Packets for a VMXNET3 Virtual Machine Adapter
Monitor traffic that flows between a virtual switch and a VMXNET3 virtual machine adapter by using the
pktcap-uw utility.
You can specify a certain capture point in the data path between a virtual switch and a virtual machine
adapter. You can also determine a capture point by traffic direction with regard to the switch and proximity
to the packet source or destination. For information about supported capture points, see Capture Points
of the pktcap-uw Utility.
Prerequisites
Verify that the virtual machine adapter is of type VMXNET3.
Procedure
1 On the host, learn the port ID of the virtual machine adapter by using the esxtop utility.
a In the ESXi Shell to the host, to start the utility, run esxtop.
b To switch to the network panel of the utility, press N.
c In the USED-BY column, locate the virtual machine adapter, and write down the PORT-ID value
for it.
The USED-BY field contains the name of the virtual machine and the port to which the virtual
machine adapter is connected.
d Press Q to exit esxtop.
2 In the ESXi Shell, run pktcap-uw --switchport port_ID.
port_ID is the ID that the esxtop utility displays for the virtual machine adapter in the PORT-ID
column.
3 In the ESXi Shell, run the pktcap-uw command with the --switchport port_ID argument and with
options to monitor packets at a particular point, filter captured packets and save the result to a file.
pktcap-uw --switchport port_ID [--capture capture_point|--dir 0|1 --stage 0|1] [filter_options]
[--outfile pcap_file_path [--ng]] [--count number_of_packets]
vSphere Networking
VMware, Inc. 214