# esxcfg-vmknic -l
# tcpdump-uw -i vmk0
tcpdump-uw -i vmk0 -s 1514
# tcpdump-uw -i vmk0 -s 9014 -B 9
# tcpdump-uw -i vmk0 -s 1514 -vvv
# tcpdump-uw -i vmk0 -s 1514 tcp
# tcpdump-uw -i vmk0 -s 1514 host x.x.x.x
# tcpdump-uw -i vmk0 -s 1514 port not 22 and port not 53
# tcpdump-uw -i vmk0 -s 1514 -w traffic.pcap
# tcpdump-uw -i vmk0 -s 1514 -C 100M -w /var/tmp/test.pcap
# tcpdump-uw -i vmk0 -s 1514 -C 100M -W 10 -w /var/tmp/test.pcap
By default, packet captures on the vmkernel network interface (vmk) only captures the network traffic moving to and from the vmkernel on that interface. It does not capture other traffic moving across the Virtual Switch.
To capture all traffic moving across the Virtual Switch: