As a starting point, refer to ESXi Network Troubleshooting Tools, specifically to the section titled "Pktcap-uw".
Under that title, look for the following graphic:
Packet captures are done by entering commands at the command line of a session via SSH (or Server Console access via KVM -- “Keyboard, Video (monitor), Mouse.”) with root access privileges.
There are a variety of points at which a traffic can be captured, depending on the type of switch in use. For example, standard vSwitch or a Distributed Virtual Switch (DVS).
Capture output can be directed to the user's screen and displayed (by parsing the output with the tcpdump-uw tool), or it can be directed to a disk file which can then be downloaded and analyzed with a tool such as Wireshark.
Plan on directing the output to a disk file, NEVER use the /tmp directory as a place to put the data.
cd /vmfs/volumes/FULL_PATH_TO_DATASTORE
cd "/vmfs/volumes/FULL_PATH_TO_DATASTORE"
cd "/vmfs/volumes/FULL_PATH_TO_DATASTORE"
mkdir Case_12345678
In vSwitch, i.e. switchport and uplink.
Switchport connects to all the vNIC and vmk adapters and uplink is the actual physical NIC (vmnic).
We will first identify the capture point based on the issue and apply the command syntax accordingly.
In the below diagram note the architecture and how VMs, kernel and physical adapters are connected.
net-stats -
l" and this will list the switchports that are mapped to vm/vmk.esxtop
" and press "n". This will show the mapping between switchport and uplink.vsish
" and press enter. "cat /net/portsets/vSwitch_name/ports/switchport_number/teamUplink
"Note: For vSwitch name and switchport number, refer to "net-stats -l
" output.
netdbg vswitch instance list
" and press enter.As an example, trace a particular vSwitch port and its associated uplink at the same time:
net-stats -l
Identify and make a note of these parameters:
Port ID returned by the esxtop command — --switchport 12345678
vmnic2 physical port to trace — --uplink vmnic2 -
Location of the output pcap file — /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/
pktcap-uw --switchport 67108879 -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.switchport.67108879.pcapng & pktcap-uw --uplink vmnic2 -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.uplink.vmnic2.pcapng &
Note: The command shell we assume here is the Bash shell. Therefore, if there is more than one uplink on the vSwitch, just add the command after the ending & and add a & at the end.kill $(lsof |grep pktcap-uw |awk '{print $1}'| sort -u)
lsof |grep pktcap-uw |awk '{print $1}'| sort -u
Notes:
Per the diagram, there are different capture points.
pktcap-uw --uplink vmnic2 --capture UplinkSndKernel,UplinkRcvKernel -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.uplink.vmnic2.UplinkSndRcvKernel.pcapng &
Example for directing the output to the screen:pktcap-uw --uplink vmnic2 --capture UplinkSndKernel,UplinkRcvKernel -o - | tcpdump-uw -r - -enn
kill $(lsof |grep pktcap-uw |awk '{print $1}'| sort -u)
pktcap-uw --switchport 67108879 ---capture VnicTx,VnicRx -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.switchport.67108879.VnicTxRx.pcapng &
pktcap-uw --switchport 67108879 ---capture VnicTx,VnicRx -o - | tcpdump-uw -r - -enn
Please note the packet capture data is not stored in ESXi logs.
pktcap-uw --switchport 67108879 ---capture VnicTx,VnicRx -s 256 -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.switchport.67108879.VnicTxRx.pcapng &
Apktcap-uw --switchport 67108879 ---capture VnicTx,VnicRx -s 256 --ip ###.###.###.### -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.switchport.67108879.VnicTxRx.pcapng &
In the above example, substitute the problem IP address that being investigated, in place of ###.###.###.###. For example, enter the default gateway IP address configured for the virtual machine. pktcap-uw --switchport 67108879 ---capture VnicTx,VnicRx -s 256 --ip ###.###.###.### --proto 0x01 -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/Case_12345678/esxi01.switchport.67108879.VnicTxRx.pcapng &
In the above example, we use 0x01 for the --proto option.Although Wikipedia may not be 100% reliable, it is a useful place to start for protocol types -- see List of IP protocol numbers.
RELATED LINKS :
To provide advice and best practices when using the pktcap-uw tool when the ESXi hosts are heavily loaded, see Considerations to run pktcap-uw under heavy network load.