Packet capture on ESXi host switchport

Get the port number:

net-stats -l

Capture the packets:

pktcap-uw --switchport <PortNum> --ng -o - --dir inputAndOutput | tcpdump-uw -r - -n

Limit the number of packets captured with “-c”:

pktcap-uw --switchport 67108878 --ng -o - --dir inputAndOutput -c 100 | tcpdump-uw -r - -n

More info:

https://www.linkedin.com/pulse/accomplish-live-wireshark-captures-esx-host-nsx-t-ashwin

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-C1CEBDDF-1E6E-42A8-A026-0C067DD16AE7.html