Capturing and Tracing Network Packets by Using the pktcap-uw Utility

Monitor the traffic that flows through physical network adapters, VMkernel adapters, and virtual machines adapters, and analyze packet information by using the graphical user interface of network analysis tools such as Wireshark.

In vSphere 5.5 or later, you can monitor packets on a host by using the pktcap-uw console utility. You can use the utility without additional installation on an ESXi host. pktcap-uw provides many points in the host network stack at which you can monitor traffic.

For detailed analysis of captured packets, you can save packet content from the pktcap-uw utility to files in PCAP or PCAPNG format and open them in Wireshark. You can also troubleshoot dropped packets and trace a packet's path in the network stack.

Note: The pktcap-uw utility is not fully supported for backward compatibility across vSphere releases. The options of the utility might change in the future.