Technical Tip: How to sniff traffic on hypervisor (ESXi) using pktcap-uw tool

Description

This article describes how to sniff traffic on hypervisor (ESXi) using the pktcap-uw tool.

Scope

For VMware ESXi.

Solution

Many Fortinet products can be run on ESXi hypervisor.
In the event of connectivity issues between Fortinet VM and other VMs, it is worthwhile to sniff traffic on the hypervisor side in order to isolate the issue. To sniff traffic on the ESXi server, it is necessary to perform the following steps:

• Enable SSH access on ESXi.

• Connect to ESXi via SSH.

• Run the following in the CLI to find the virtual switchport of the VM:

net-stats -l | grep <VM name>

For example:

net-stats -l | grep VM
123 5 7 vSwitch0 00:0c:29:4e:41:3b VM

• In vSphere v6.5 or earlier, it is necessary to specify the direction of the sniffing (either input or output).

• (123) Switchport numbers for particular VMs can be found using the net-stats command.

• 'O' defines a path where the pcap file will be created and specifies file name.

• 'dir' specify direction (either input or output):

pktcap-uw --switchport 123 -o /tmp/in.pcap --dir input
pktcap-uw --switchport 123 -o /tmp/out.pcap --dir output

In vSphere v6.7 or later, it is possible to sniff traffic in both directions by setting --dir 2:

pktcap-uw --switchport 123 -o /tmp/both.pcap --dir 2

• Run Ctrl-C in the CLI to stop sniffing.

• Download the pcap file(s) created in this process over SSH from ESXi.