I recently ran into an issue where we needed to capture some packets from the vmk interface on a Nutanix/vSphere host. I found this great utility for that, pktcap-uw, however it only captures traffic in one direction by default. Thankfully I found someone with the info on how to run both incoming and outgoing captures at the same time.

1. SSH to the host
2. Update the cmd below to reflect your vmk port or whatever you are trying to capture
3. Run this cmd

4. pktcap-uw --vmk vmk0 --dir 0 -o /tmp/vmk0_in.pcap & pktcap-uw --vmk vmk0 --dir 1 -o /tmp/vmk0_out.pcap &

5. Shut down the capture after your done with this cmd

6. kill $(lsof |grep pktcap-uw |awk '{print $1}'| sort -u)

7. Use WinSCP to connect to the host
8. Copy vmk0_in.pcap & vmk0_out.pcap files from /tmp/*
9. Save them somewhere useful
10. Open in wireshark
11. Click File > Merge > pick the 2nd file
12. And you should be presented with a capture with both incoming and outgoing packets.

Using the pktcap-uw tool in ESXi 5.5 and later (2051814)

@beandrew – his reply is what got this working for me