How to use the Capture Points of the pktcap-uw Utility

Learn how to use the capture points of the pktcap-uw utility to monitor packets when a function handles them at a specific place in the network stack on a host.

Overview of Capture Points

A capture point in the pktcap-uw utility represents a place in the path between a virtual switch on one side and a physical adapter, VMkernel adapter or a virtual machine adapter on the other.

You can use certain capture points in combination with an adapter option. For example, you use the UplinkRcv point when you capture uplink traffic. You can address other points standalone. For example, use the Drop point to inspect all dropped packets.

Note: Certain capture points of the pktcap-uw utility are designed for VMware internal use only and you should use them only under the supervision of VMware Technical Support. These capture points are not described in the vSphere Networking guide.

Option for Using Capture Points in the pktcap-uw Utility

To examine a packet state or content at a capture point, add the --capturecapture_point option to the pktcap-uw utility.

Auto-Selecting a Capture Point

For traffic that is related to a physical, VMkernel or VMXNET3 adapter, by combining the --dir and --stage options you can auto-select and switch between capture points to examine how a packet changes before and after a point.