In pktcap-nw, without specifying the capture point, you see one packet fom the default capture point PortInput (That's the ICMP echo reply): Tcpdump-uw: verbose output suppressed, use -v or -vv for full protocol decode In tcpdump-nw you see both packets, the ICMP echo request, and the reply: To demonstrate that we will use a simple ICMP packet (ping). PortInput: Packets from the VMkernel adapter to a port on the virtual switch.PortOutput: Packets from a port on the virtual switch to the VMkernel adapter.For capturing VMkernel traffic you have 2 capture points: With capture points you can define at which position you want to capture the traffic. When you monitor vmk0 with tcpdump-nw there is only one capture point, the VMkernel interface directely and you can see both, incoming and outgoing packets. The pktcap-uw utility introduces the concept of capture points.
There is no concept of traffic flow in tcpdump-nw.
The pktcap-uw utility, introduced in ESXi 5.5 can capture traffic that flows through physical network adapters, VMkernel adapters, and virtual machines adapters. The tcpdump-uw utility captures traffic from VMkernel adapters.
0 kommentar(er)
