Bi-Directional Packet Capture on ESXi

I recently ran into an issue where we needed to capture some packets from the vmk interface on a Nutanix/vSphere host. I found this great utility for that, pktcap-uw, however it only captures traffic in one direction by default. Thankfully I found someone with the info on how to run both incoming and outgoing captures at the same time.

  1. SSH to the host
  2. Update the cmd below to reflect your vmk port or whatever you are trying to capture
  3. Run this cmd
  4. pktcap-uw --vmk vmk0 --dir 0 -o /tmp/vmk0_in.pcap & pktcap-uw --vmk vmk0 --dir 1 -o /tmp/vmk0_out.pcap &
  5. Shut down the capture after your done with this cmd
  6. kill $(lsof |grep pktcap-uw |awk '{print $1}'| sort -u)
  7. Use WinSCP to connect to the host
  8. Copy vmk0_in.pcap & vmk0_out.pcap files from /tmp/*
  9. Save them somewhere useful
  10. Open in wireshark
  11. Click File > Merge > pick the 2nd file
  12. And you should be presented with a capture with both incoming and outgoing packets.

Using the pktcap-uw tool in ESXi 5.5 and later (2051814)

@beandrew – his reply is what got this working for me

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s