Procedure to capture the traffic on target VM on vDS port

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Symptoms:

This article describes a procedure to evaluate traffic in and out of a vDS port, by capturing traffic at an ESXi host level for a target VM.

 

Resolution

To capture the traffic:

1. Determine the ESXi host that houses the VM where you would like to perform the traffic capture.
2. From that ESXi host, run "netstats -l" to list the vDS port numbers for VMs on that host.
3. Identify the PortNum where you would like to perform the capture.
4. Open two SSH sessions to that ESXi host
5. From SSH Session 1, run "pktcap-uw --switchport PortNum --dir 0 -o capture-outbound.pcap" (where PortNum is the port identified in step 3)
6. From SSH Session 2, run "pktcap-uw --switchport PortNum --dir 1 -o capture-inbound.pcap"
7. Use WinSCP to pull the pcap files from the ESXi host
8. Consolidate the pcap files using Wireshark File Merge