Capturing and Tracing Network Packets by Using the pktcap-uw Utility on Skyline Collector

Products

• VMware

Issue/Introduction

Monitor the traffic that flows through Skyline Collector and analyze packet information by using the graphical user interface of network analysis tools such as Wireshark.

For a detailed analysis of captured packets, you can save packet content from the pktcap-uw utility to files in PCAP or PCAPNG format and open them in Wireshark. You can also troubleshoot dropped packets and trace a packet's path in the network stack.

Prerequisites:

Please create a snapshot on the Skyline Collector virtual machine, before performing any steps mentioned to generate packet capture.

Resolution

Follow these steps to install tcpdump and generate Packet Capture
 

1. Using the vSphere Client, open the remote console of the Skyline Collector virtual appliance.
2. Log in to the console of the Skyline Collector virtual appliance with user 'root'.

Note: To install tcpdump, we would need to first remove package “photon_vasecurity”, as tcpdump is being blocked.

3. Command to remove package “photon_vasecurity”

tdnf remove photon_vasecurity

4. If you receive an error when we execute the command tdnf remove photon_vasecurity there is error

Error: “Refreshing metadata for: VMware Photon Extras 2.0(X86_64)
curl+60:Peer certificate cannot be authenticated with given CA certificates Download error: 1261. Retrying”

5. Check if the Collector is configured with a Proxy Server, if yes you would first have to insert the proxy certificates into the PhotonOS Cert Store
6. Please follow the steps in the KB to insert the proxy certificates into the PhotonOS Cert Store - https://kb.vmware.com/s/article/82118
7. Command to install tcpdump

tdnf -y install tcpdum
tdnf -y install tcpdum

Execute the below command to generate Packet Capture on Skyline Collector appliance
tcpdump -i eth0 udp port 443 ( tcpdump -i eth0 udp port 443 -w /tmp/collector.pcap)