Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

Skip to main content

Products and Accounts

Support

Knowledge

Communities

Success

Learning

My Subscriptions

Loading

Knowledge Base

Capturing virtual switch traffic with tcpdump and other utilities (1000880)

Last Updated: 3/9/2015Categories: TroubleshootingTotal Views: 99664Language:
Chinese (Simplified)JapaneseSpanishEnglish

2 like this article

Subscribe to get an email
newsletter with new updates

2 people found this helpful Please provide article feedback:

Details

This article provides information about capturing ESX network traffic.

There are two ways to capture traffic in an ESX environment:

On the Service Console level:

ESX ships with the tcpdump utility. For more information on usage, see Troubleshooting network issues by capturing and sniffing network traffic via tcpdump (1004090).

On the guest operating system (GOS) level:

Depending on the operating system type, different utilities may be available to download for capturing network traffic.

Monitoring virtual switch traffic using tcpdump or other packet-capture utilities requires a port group with non-default security policies set.

Attempting to capture traffic without adjusting the security policies results in silent failure of the capture operation.

Solution

These steps describe setting up a vSwitch and/or a port group in promiscuous mode for tcpdump:

To monitor traffic via VMware Service Console (SC), a port group and a vswif interface with security settings modified to promiscuous mode accept is required for capturing.

To monitor traffic via the virtual machine, the virtual machine's virtual NIC must be set to promiscuous mode accept, however this step is often accomplished by the capturing utility installed on guest operating systems. The Virtual Switch (vSwitch) and port group security settings must also be modified to accept all traffic ( promiscuous mode accept).

To capture all traffic of the Virtual Switch, the vSwitch security setting is set to promiscuous mode accept.

To capture only the traffic of a port group, only that particular port group security setting is modified to promiscuous mode accept.

A layer 3 IP address is used by the capturing utility, therefore you must have a Service Console with an IP address in the desired subnet for capturing. This also applies to guest operating systems.

To monitor VMkernel Traffic, place a Service Console on the VMkernel virtual switch, and follow the procedure below.

These steps must be applied as a whole if the environment requires total dedicated virtual switch, port group, and service console, or can be used as reference to modify existing network settings. To modify only the port group, go to step 3 above.

Create a new service console portgroup named COS_tcpdump (or another name which makes sense in your environment):

Connect to the ESX host using VI Client / vSphere Client.

Click the ESX host, then click the Configuration tab.

Click Networking under Hardware.

Click Add Networking, which is located at the top right. The Add Network Wizard window appears.

Click Service console, then click Next.

Select Create a virtual switch and select the NIC to be associated with the virtual switch and click Next.

Enter a Network Label for the server console (in this example, COS_tcpdump), and provide a VLAN ID (optional).

On ESX 4.x, click Next.

Assign IP information using DHCP or manually by entering an IP Address and Subnet Mask, then click Next.

Click Finish to create the switch.

Click Properties next to the new virtual switch to edit its properties.

Highlight the newly created Service Console and click Edit to modify its properties.

In the vSwitch Properties window, click the Security tab and change all three Policy exceptions to Accept and click OK.

Close the Properties window. You are ready to run tcpdump on this vswif interface.

Additional Information
To capture tcpdump traffic for ESXi hosts, see Capturing a network trace in ESXi using Tech Support Mode or ESXi Shell (1031186).
Additional Information
For translated versions of this article, see:

Español: Capturar el tráfico de conmutador virtual con tcpdump y otras utilidades (2065633)

日本語: tcpdump などのユーティリティを使用して仮想スイッチのトラフィックをキャプチャする (2076750)

简体中文: 使用 tcpdump 和其他实用程序捕获虚拟交换机流量 (2077556)

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseSpanishEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware ESX Server

Related Versions:

VMware ESX Server 3.5.x

VMware ESX Server 3.0.x

VMware ESX 4.1.x

VMware ESX 4.0.x

Take Our Survey

Was this article helpful?

YES

NO

Copyright © 2005-2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.

Terms of Use

Your California Privacy Rights

Privacy

Accessibility

Cookie Settings

Support Assistant