Examine how packets change when they pass through a vSphere Network Appliance (DVFilter).

DVFilters are agents that reside in the stream between a virtual machine adapter and a virtual switch. They intercept packets to protect virtual machines from security attacks and unwanted traffic.

1

(Optional) To find the name of the DVFilter that you want to monitor, in the ESXi Shell, run the summarize-dvfilter command.

The output of the command contains the fast-path and slow-path agents of the DVFilters that are deployed on the host.

2

Run the pktcap-uw utility with the --dvfilter dvfilter_name argument and with options to monitor packets at a particular point, filter captured packets and save the result to a file.

pktcap-uw --dvFilter dvfilter_name --capture PreDVFilter|PostDVFilter [filter_options] [--outfile pcap_file_path [--ng]] [--count number_of_packets]

where the square brackets [] enclose optional items of the pktcap-uw --dvFilter vmnicX command and the vertical bars | represent alternative values.

a

Use the --capture option to monitor packets before or after the DVFilter intercepts them.

pktcap-uw Command Option

Goal

--capture PreDVFilter

Capture packets before they enter the DVFilter.

--capture PostDVFilter

Capture packets after they leave the DVFilter.

b

Use a filter_options to filter packets according to source and destination address, VLAN ID, VXLAN ID, Layer 3 protocol, and TCP port.

For example, to monitor packets from a source system that has IP address 192.168.25.113, use the --srcip 192.168.25.113 filter option.

c

Use options to save the contents of each packet or the contents of a limited number of packets to a .pcap or .pcapng file.

To save packets to a .pcap file, use the --outfile option.

To save packets to a .pcapng file, use the --ng and --outfile options.

You can open the file in a network analyzer tool such as Wireshark.

By default, the pktcap-uw utility saves the packet files to the root folder of the ESXi file system.

d

Use the--count option to monitor only a number of packets.

3

If you have not limited the number of packets by using the --count option, press Ctrl+C to stop capturing or tracing packets.

If the contents of the packet are saved to a file, copy the file from the ESXi host to the system that runs a graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.