Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Capturing a network trace in ESXi using Tech Support Mode or ESXi Shell (1031186)

Last Updated: 3/20/2024Categories: How toTotal Views: 33597Language:
Chinese (Simplified)JapaneseEnglish

11 like this article

Subscribe to get an email
newsletter with new updates

11 people found this helpful Please provide article feedback:

Purpose

This article provides information on capturing network traces in ESXi 4.0 Update 1, ESXi 4.1, and ESXi 5.x. You may want to capture the network traces to investigate network problems.

Resolution

To capture the network traces in ESXi 4.x and ESXi 5.x, you can use the tcpdump-uw command in the Tech Support Mode.

Note: In ESXi 5.x, Tech Support Mode is replaced by ESXi Shell. For more information, see Using ESXi Shell in ESXi 5.0 and 5.1 (2004746).

The tcpdump-uw command is based on the standard tcpdump utility. Network traces are captured from the perspective of a network interface. The examples in this article use vmk0, though any VMKernel network interface could be used.

Capturing network traces with tcpdump-uw

To list the vmkernel interfaces, use the esxcfg-vmknic command with the -l option:

# esxcfg-vmknic -l

To display packets on the vmkernel interface vmk0, use the tcpdump-uw command with the -i option:

# tcpdump-uw -i vmk0

Note:

By default, the tcpdump and tcpdump-uw commands capture only the first 68 bytes of data from a packet.

For ESXi 5.5, see Using the pktcap-uw tool in ESXi 5.5 (2051814).

To capture the entire packet, use the tcpdump-uw command with the -s option with a value of 1514 for normal traffic and 9014 if Jumbo Frames are enabled.

Normal traffic: # tcpdump-uw -i vmk0 -s 1514
Jumbo Frames enabled: # tcpdump-uw -i vmk0 -s 9014 -B 9

Note: By default, tcpdump-uw can only capture a maximum of 8138 bytes due to buffer constraints. The -B 9 option increases the buffer to allow the capture of up to 9014 bytes.

To display all of the packets on vmk0 with verbose detail, use the tcpdump-uw command with the -vvv option:

# tcpdump-uw -i vmk0 -s 1514 -vvv

Note: Refer the help page for tcpdump-uw command for more -v options.

To display only the TCP packets on vmk0, use the tcp option with the tcpdump-uw command.

# tcpdump-uw -i vmk0 -s 1514 tcp

To see traffic to/from only a single IP address, you can use the host option:

# tcpdump-uw -i vmk0 -s 1514 host x.x.x.x

To avoid seeing unwanted traffic types in the tcpdump-uw output, use the not option. For example, to filter out DNS and SSH traffic, use the following command:

# tcpdump-uw -i vmk0 -s 1514 port not 22 and port not 53

Note: This is useful when doing a packet capture on a VMkernel interface when that same interface is also being used for an active SSH session.

To save the dump in pcap format for later use with Wireshark, use the traffic.pcap option.

# tcpdump-uw -i vmk0 -s 1514 -w traffic.pcap

If the trace is running for long time, you can split the trace pcap file to chunks of desired size using the-C option.

# tcpdump-uw -i vmk0 -s 1514 -C 100M -w /var/tmp/test.pcap

To limit the log files to a specified number, you can use the -W option. You can use this option if a trace must be set running for a long period of time, waiting for an even to occur.

For example:

# tcpdump-uw -i vmk0 -s 1514 -C 100M -W 10 -w /var/tmp/test.pcap

This command creates 10 trace files of size 100MB each. This ensures that you do not run out of space on ESX.

Note: This option has the same effect of rotating the log files.

Related Information

By default, packet captures on the vmkernel network interface (vmk) only captures the network traffic moving to and from the vmkernel on that interface. It does not capture other traffic moving across the Virtual Switch.

To capture all traffic moving across the Virtual Switch:

Use a third-party packet sniffer software inside one of the virtual machines on the vSwitch.

The network interface of the virtual machine will need to be configured for promiscuous mode. For more/related information, see Configuring promiscuous mode on a virtual switch or portgroup (1004099).

Using the pktcap-uw tool in ESXi 5.5 and later
Configuring the size of network packet trace buffer (2054811)

ESXi で Tech Support モードまたは ESXi Shell を使用してネットワーク トレースを取得する
使用技术支持模式或 ESXi Shell 在 ESXi 中捕获网络跟踪

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

Related Versions:

VMware vSphere ESXi 5.5

VMware vSphere ESXi 5.1

VMware vSphere ESXi 5.0

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESXi 4.0.x Installable

VMware ESXi 4.0.x Embedded

Take Our Survey

Support Assistant