In my previous post I explained how to quickly interpret a network capture on ESXi by using pktcap-uw and tcpdump-uw. This works great to get some information at a glance. But what if you require some further analysis? Well, then Wireshark is probably your tool of choice. Check out the rest of this blog post to learn how to set up remote capturing so you don’t need temporary storage on ESXi for your capture files.
As a vSphere admin you are sometimes tasked with investigating network issues. You don’t always have VM access so you need to diagnose at the ESXi level. Now as some of you may know quickly gaining insight in VM network traffic by capturing it on the ESXi level is a rather complex task. The tool at your disposal for capturing VM traffic is called pktcap-uw and one of it’s biggest shortcomings is that it doesn’t interpret the packets.
A feature that was introduced in vSphere 7 is the ability to use pcap (tcpdump) filters with pktcap-uw. One of the use cases where this can be useful is filtering for TCP control bits.