Network traffic impacted when using pktcap-uw

Products

• VMware vSphere ESXi 8.0
• VMware vSphere ESX 7.x

Issue/Introduction

• Using pktcap-uw on multiple ports to capture traffic.
• The network may be down or packet drops are observed, while pktcap-uw is being run.
• The networking may stabilize once the pktcap-uw session is stopped.

Environment

ESXi 7.0
ESXi 8.0

Cause

The pktcap-uw session needs to duplicate captured packets and allocate memory, to save packet data.
When the pktcap-uw tool is used in a environment which is busy, due to heavy networking load or resource constrained, (cpu and/or memory) and running multiple sessions and/or unfiltered, can lead to network packet related resources running out and may lead to improper handling of normal traffic, packets can be dropped or network connection broken.

Resolution

• Use pktcap-uw cautiously to avoid impacting business traffic.
• Only capture interested traffic, use filters
• No more than 4 pktcap-uw sessions should run at the same time (no-vprobe).
• Only one vprobe based session is allowed.

Note:
pktcap-uw on any ENS port is based on vprobe.
pktcap-uw is intended as a debugging tool rather than a monitoring tool and we do not recommend running it for extended periods as it can affect business traffic.
pktcap-uw cannot guarantee that all packets will be captured, it can only make an effort to do so.

Additional Information

Packet capture on ESXi using the pktcap-uw tool
Improper termination of pktcap-uw causes Userworld exhaustion and ESXi host management agent failures