6.7

Table Of Contents
You can replace the --vmk vmkX option with --switchport vmkernel_adapter_port_ID, where
vmkernel_adapter_port_ID is the PORT-ID value that the network panel of the esxtop utility displays
for the adapter.
If you run the pktcap-uw --vmk vmkX command without options, you obtain the content of packets
that are leaving the VMkernel adapter.
a To check transmitted or received packets at a specific place and direction, use the --capture
option, or combine the values of the --dir and --stage options.
pktcap-uw Command Options Goal
--dir 1 --stage 0 Monitor packets immediately after they leave the virtual switch.
--dir 1 Monitor packets immediately before they enter the VMkernel adapter.
--dir 0 --stage 1 Monitor packets immediately before they enter the virtual switch.
b Use a filter_options to filter packets according to source and destination address, VLAN ID,
VXLAN ID, Layer 3 protocol, and TCP port.
For example, to monitor packets from a source system that has IP address 192.168.25.113, use
the --srcip 192.168.25.113 filter option.
c Use options to save the contents of each packet or the contents of a limited number of packets to
a .pcap or .pcapng file.
n
To save packets to a .pcap file, use the --outfile option.
n
To save packets to a .pcapng file, use the --ng and --outfile options.
You can open the file in a network analyzer tool such as Wireshark.
By default, the pktcap-uw utility saves the packet files to the root folder of the ESXi file system.
d Use the--count option to monitor only a number of packets.
3 If you have not limited the number of packets by using the --count option, press Ctrl+C to stop
capturing or tracing packets.
What to do next
If the contents of the packet are saved to a file, copy the file from the ESXi host to the system that runs a
graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.
Capture Dropped Packets
Troubleshoot lost connectivity by capturing dropped packets through the pktcap-uw utility.
A packet might be dropped at a point in the network stream for many reasons, for example, a firewall rule,
filtering in an IOChain and DVfilter, VLAN mismatch, physical adapter malfunction, checksum failure, and
so on. You can use the pktcap-uw utility to examine where packets are dropped and the reason for the
drop.
vSphere Networking
VMware, Inc. 217