6.7

where the square brackets [] enclose the options of the pktcap-uw --switchport port_ID
command and the vertical bars | represent alternative values.
If you run the pktcap-uw --switchport port_ID command without options, you obtain the content
of packets that are incoming to the standard or distributed switch in the console output at the point
when they are switched.
a To check packets at another capture point or direction in the path between the guest operating
system and the virtual switch, use the --capture option or combine the values of the --dir and
--stage options.
pktcap-uw Command Options Goal
--capture Vmxnet3Tx
Monitor packets when they pass from the virtual machine to the switch.
--capture Vmxnet3Rx
Monitor packets when they arrive to the virtual machine.
--dir 1 --stage 0 Monitor packets immediately after they leave the virtual switch.
--dir 1
Monitor packets immediately before they enter the virtual machine.
--dir 0 --stage 1 Monitor packets immediately after they enter the virtual switch.
b Use a filter_options to filter packets according to source and destination address, VLAN ID,
VXLAN ID, Layer 3 protocol, and TCP port.
For example, to monitor packets from a source system that has IP address 192.168.25.113, use
the --srcip 192.168.25.113 filter option.
c Use options to save the contents of each packet or the contents of a limited number of packets to
a .pcap or .pcapng file.
n
To save packets to a .pcap file, use the --outfile option.
n
To save packets to a .pcapng file, use the --ng and --outfile options.
You can open the file in a network analyzer tool such as Wireshark.
By default, the pktcap-uw utility saves the packet files to the root folder of the ESXi file system.
d Use the--count option to monitor only a number of packets.
4 If you have not limited the number of packets by using the --count option, press Ctrl+C to stop
capturing or tracing packets.
Example: Capture Packets That Are Received at a Virtual Machine from an IP Address
192.168.25.113
To capture the first 60 packets from a source that is assigned the IP address 192.168.25.113 when they
arrive at a virtual machine adapter with port ID 33554481 and save them to a file called
vmxnet3_rcv_srcip.pcap, run the following pktcap-uw command:
pktcap-uw --switchport 33554481 --capture Vmxnet3Rx --srcip 192.168.25.113 --outfile
vmxnet3_rcv_srcip.pcap --count 60
vSphere Networking
VMware, Inc. 215