Knowledge Base
Capturing virtual switch traffic with tcpdump and other utilities
Details
- Service Console level: ESX is shipped with TCPDUMP utility.
Refer to article Troubleshooting network issues by capturing and sniffing network traffic(1004090)
- Guest Operating system (GOS) level: Depending on operating system type different utilities may be available to download for capturing network traffic.
Monitoring virtual switch traffic using TCPDUMP or other packet-capture utilities requires a port group with non-default security policies set.
Attempting to capture traffic without adjusting the security policies result in silent failure of the capture operation.
Solution
The following describes setting up a vSwitch or/and a port group in promiscuous mode for TCPDUMP:
- To monitor traffic via VMware Service Console (SC) a port group and a vswif interface with security setting modified to (promiscuous mode accept) is required for capturing.
- To monitor traffic via the virtual machine the virtual machine’s virtual NIC is also required to be set promiscuous mode accept, however this step is accomplish often by the capturing utility installed on guest operating systems. The Virtual Switch (vSwitch) and port group security setting are also required to be modified to accept all traffic (promiscuous mode accept).
- To capture all traffic of the Virtual Switch the the vSwitch security settings is set to promiscuous mode accept.
- To capture only the traffic of a port group, only that particular port group security settings is modified to promiscuous mode accept.
- A layer 3 IP address is used by the capturing utility, that is why one needs Service Console with IP address in the desired subnet for capturing. This also applies to guest operating systems.
- To monitor VMkernel Traffic place a service console on VMkernel virtual switch, and utilize the below technique.
The following steps must be applied as a whole if the environment requires total dedicated virtual switch, port group, and service console or can be used as reference to modify exciting network setting. Go to step 3 of these instruction for just modifying the port group:
- Create a new service console portgroup named COS_tcpdump (or whatever name makes sense to you).
- Connect to the ESX Server host using VI Client.
- From the main Networking panel, click Add Networking and choose Service Console. (See Figure 1.)
- Click Next.
Figure 1:
- Select Create a virtual switch. (See Figure 2.)
Figure 2:
- Click Next
- Assign IP information accordingly. (See Figure 3.)
Figure 3:
- Click Next and Finish.
- Open the properties for this port group and click Edit. (See Figure 4 and Figure 5.)
Figure 4:
Figure 5:
- Click the Security tab and mark all three policy exceptions as Accept. Click OK. (See Figure 6.)
Figure 6:
-
Close the Properties edit panel. You are ready to run tcpdump on this vSwif.
Note: The known problem referenced as "tcpdump captures only outbound traffic when there are multiple uplinks per portgroup" is resolved in VMware ESX 3.0.2.