Using the pktcap-uw tool

• To obtain basic help and syntax information, use the -h option:
  
  # pktcap-uw -h |more
   
• To view a live capture of a vmkernel ports traffic:
  
  # pktcap-uw --vmk vmkX
  
  For example, to capture frames/packets on vmk0:
  
  # pktcap-uw --vmk vmk0
   
• To view a live capture of a specific physical network card on the host vmnic:
  
  # pktcap-uw --uplink vmnicX
  
  For example, to capture frames/packets on vmnic7:
  
  # pktcap-uw --uplink vmnic7
   
• To view a live capture of a particular vSwitch port for a virtual machine, use the --switchport option:
  
  # pktcap-uw --switchport switchportnumber
  
  For example, to capture frames or packets to and from a virtual machine connected to dvSwitchport 8:
  
  # pktcap-uw --switchport 8
   
• To capture the output to a file, use -o option:
  
  # pktcap-uw --vmk vmk# -o file.pcap
  
  For example, to capture the packets from vmk0 and save to test.pcap file under /tmp directory:
  
  # pktcap-uw --vmk vmk0 -o /tmp/test.pcap
  
  Notes:
  • When you are using the -o option, output is in pcap format regardless of other settings.
  • To specify how many seconds pktcap-uw will run, use -G <seconds>.
  • To specify pktcap-uw to run only until the output is a certain file size (in megabytes), use -C <file_size>.
  • To end the capture, ensure to use Ctrl-C multiple times instead of Ctrl-Z because Ctrl-Z may leave background processes running that may prevent subsequent pktcap-uw commands from running and report the error:
    
    error: Can't create the session, Exiting

Advanced Usage: trace multiple ports at the same time

As an example, trace a particular vSwitch port and its associated uplink at the same time:

1. To get the vSwitch port number, run this command:
   
   net-stats -l

2. Identify and make a note these parameters:

   Port ID returned by the esxtop command — --switchport 50331665

   vmnic2 physical port that you want to trace — --uplink vmnic2 -

   location of the output pcap file — /tmp/vmnic2.pcap

3. Run the pktcap-uw command to capture packets at both points simultaneously:
   
   pktcap-uw --switchport 50331665 -o /tmp/50331665.pcap & pktcap-uw --uplink vmnic2 -o /tmp/vmnic2.pcap &
   
   Note: The command shell we assume here is the Bash shell. Therefore, if you have more than one uplink on the vswitch, you just add the command after the ending & and add a & at the end.
    
4. You can stop pktcap-uw tracing with the kill command:
   
   kill $(lsof |grep pktcap-uw |awk '{print $1}'| sort -u)
    
5. Run this command to check that all pktcap-uw traces are stopped:
   
   lsof |grep pktcap-uw |awk '{print $1}'| sort -u