For example in my case it will be: sftp Run the command: get /tmp/CAPTURE. I’m using an SFTP on Ubuntu, but you can use any SFTP you would like. Now we need to export CAPTURE.pcap to an external SFTP server for easy viewing via WIRESHARK.

If you wish to run a packet capture on one of your virtual machines and export the output to a file named Capture.pcap in the /tmp/ directory of your host:Ĭommand: pktcap-uw -switchport -o /tmp/CAPTURE.pcap.If you wish to run a packet capture on vmnic3 and export the output to a file named Capture.pcap in the /tmp/ directory of your host:Ĭommand: pktcap-uw -uplink vmnic3 -o /tmp/CAPTURE.pcap.*Notice how as I press enter the number of packets increases from 35 > 41 > 48 > and finally 55. If you wish to run a packet capture on vmk0 and export the output to a file named CAPTURE.pcap in the /tmp/ directory of your host:Ĭommand: pktcap-uw -vmk vmk0 -o /tmp/CAPTURE.pcap.Confirm the virtual port number & client name of the device you wish to run the capture on:.This is done by logging in directly to the ESXi via CIMC or KVM switch:Ĭapturing packets on physical interface, VMkernel, and VM switchport: You need to enable SSH on the ESXi host that is managing your VMs.It’s easier if you save the capture and transfer it via SFTP to view via wireshark

By default the captured packets are displayed on the terminal.

You can run a capture on the physical network card, vmkernel, or the virtual switchport of a particular virtual machine.

This feature only captures packets in one direction and defaults to inbound.

Ssh version pcap wireshark