You use the capture points of the pktcap-uw utility to monitor packets when a function handles them at a specific place in the network stack on a host.
Overview of Capture Points
A capture point in the pktcap-uw utility represents a place in the path between a virtual switch on one side and a physical adapter, VMkernel adapter or a virtual machine adapter on the other.
You can use certain capture points in combination with an adapter option. For example, you use the UplinkRcv point when you capture uplink traffic. You can address other points standalone. For example, use the Drop point to inspect all dropped packets.
Option for Using Capture Points in the pktcap-uw Utility
To examine a packet state or content at a capture point, add the --capturecapture_point option to the pktcap-uw utility.
Auto-Selecting a Capture Point
For traffic that is related to a physical, VMkernel or VMXNET3 adapter, by combining the --dir and --stage options you can auto-select and switch between capture points to examine how a packet changes before and after a point.