How to capture network traffic within Tanzu Application Service

Products

• VMware Tanzu Application Service for VMs

Issue/Introduction

How can I view information on the network traffic passing between VMs within Tanzu Application Service (TAS)?

Resolution

There are times when implementing Tanzu Application Service for VMs where it becomes necessary to troubleshoot network performance. The support engineer you are working with may request you take a packet capture or tcpdump. A packet capture in conjunction with logs provided by TAS for VMs allows engineers to see individual packets of data as they arrive and are transmitted by your VM.

On a Linux VM/container, the command to take a packet capture is tcpdump. A tcpdump is a continuous capture of packet information on a VM, container, etc., as it is continuous until stopped storage could be exhausted by a long capture. In order to mitigate this it is recommended to format your tcpdump command to produce a file or series of files under a certain size.

A recommended format for a tcpdump command is as follows:

tcpdump -i <interface> -W <file count value> -C <size value> -w <filename>.pcap

Each of the flags appended to the tcpdump command serve a specific purpose.
 

-i indicates the interface you want to capture traffic from.

Note: in some cases, such as on a Diego Cell where there are multiple interfaces for c2c networking and in those situations -i should be dropped from the command.   
 

-W stipulates the number of files to be created. In most cases 2 is acceptable however 3 is preferred.

Note: creating multiple files allows rolling captures (captures intended to be run for long periods) to have a larger buffer before they overwrite data potentially removing the capture of the issue.
 

-C determines the size of each file. By limiting the file size of the capture will eliminate any risk of storage being exhausted on the VM in question.

Note: Storage size is multiplied by 1,000,000 bytes. i.e 10 = 10,000,000 bytes or ~10 MB

-w allows you to determine the filename for captures. Always append .pcap or .pcapng if you intend to open these files in an application such as Wireshark for further analysis.

With your properly formatted packet capture now running, you should be able to reproduce the failure you are observing. Once the you have reproduced the failure, note the time the issue occurred and stop the packet capture by either pressing ctrl + c in your terminal session or killing the Process ID using kill <process ID>. 

With your packet capture stopped you can now use scp to move the file from the VM to a location you can access to download it. Upload your packet captures to your case and notify Tanzu Support within your case.