SSH on to the ESXi host the VM resides on and run command below. Replace VM-NAME with your VM’s name.
esxcli network vm list | grep -i VM-NAME
COMMAND OUTPUT:
1122341 VM-NAME dvportgroup-202593
Copy digits at beginning of output – 1122341 into command below and run command.
esxcli network vm port list -w 1122341
COMMAND OUTPUT:
Port ID: 33554507 vSwitch: VDS or VSS Name Portgroup: dvportgroup-202593 DVPort ID: 323 MAC Address: 00:50:56:91:72:03 IP Address: 0.0.0.0 Team Uplink: vmnic1 Uplink Port ID: 33554434 Active Filters:
Copy Port ID at the beginning of output – 33554507 into capture commands below and run captures.
FOR EGRESS CAPTURE (default)
pktcap-uw --switchport 33554507 -o /tmp/VM-NAME-outbound.pcap
FOR INGRESS CAPTURE
pktcap-uw --switchport 33554507 --dir 1 -o /tmp/VM-NAME.pcap
Install WinSCP, connect to host over SCP, download pcap file from tmp folder, analyze in Wireshark
More info —