NSX CLI Guide

Associated Commands:

CLI Description Command

Delete all packet capture sessions


Delete all packet capture sessions.
del all capture sessions

Delete packet capture session


Delete a packet capture session configuration.
del capture session <dpd-number-session-id-arg>

Delete a configured packet capture session


Delete a packet capture session configuration.
del capture session <dpd-number-session-id-arg>

Delete an interface from a packet capture session


Delete the specified interface from a packet capture session configuration. If you are only monitoring one interface, this deletes the monitoring session configuration.
del capture session <dpd-number-session-id-arg> interface <dpd-uuid-name-port-arg>

Delete an interface from a packet capture session


Delete the specified interface from a packet capture session configuration. If you are only monitoring one interface, this deletes the monitoring session configuration.
del capture session <dpd-number-session-id-arg> interface <variable-interface-name>

Delete a configured packet capture session


Delete a packet capture session configuration.
del capture session <esx-session-id-arg>

Delete packet capture session


Delete the specified packet capture session.
del capture session <session-id-arg>

Display packet capture result


Display the result of the specified packet capture session with the tcpdump command.
display capture session <session-id-arg>

Display packet capture result


Display packet capture result with command tcpdump.
display capture session <session-id-arg> parameters <capture-options-arg>

Query all packet capture sessions


Display information for all packet capture sessions.
get all capture sessions

Display a packet capture session


Display information about the specified packet capture session.
get capture session <dpd-number-session-id-arg>

Display a packet capture session


Display information about the specified packet capture session.
get capture session <esx-session-id-arg>

Query packet capture session


Display information for the specified packet capture session.
get capture session <session-id-arg>

Display packet capture sessions


Display configured packet capture sessions. Session 0 is reserved for captures started with the start capture interface <interface-name> command.
get capture sessions

Display packet capture sessions


Display configured packet capture sessions.
get capture sessions

Display packet capture on session


Start a packet capture. You must have already configured the packet capture with the set capture session <session-number> interface <port-uuid-name> direction <direction> command in basic mode, or with the set capture session <session-number> direction <direction> command in path mode.

Use the get capture sessions command in basic mode to see all configured capture sessions.

set capture session <dpd-number-session-id-arg>

Monitor current port in a packet capture session


Configure a packet capture using the current interface in the path. You can change the current interface and run this command again to configure multiple interfaces on the same packet capture session.

Start the packet capture with the set capture session <session-number> command in either basic or path mode, or with the set capture session <session-number> [file <filename> [count <packet-count> [expression <expression> command in basic mode.

Use the get capture sesssions command in basic mode to see all configured capture sessions.

set capture session <dpd-number-session-id-arg> direction <capture-direction-arg>

Monitor a port in a packet capture session


Configure a packet capture using the specified interface. You can run this command multiple times to configure multiple interfaces on the same packet capture session.

To run the packet capture using this configuration, use the set capture session <session-number> [file <filename>] [count <packet-count>] [expression <expression>] command.

If you need to capture packets from only one interface, you can configure and run the packet capture with a single command: start capture interface <interface-name> [file <filename>] [count <packet-count>] [expression <expression>].

Use the get capture sessions command to see all configured capture sessions.

set capture session <dpd-number-session-id-arg> interface <variable-interface-name> direction <capture-direction-arg>

Start packet capture for the specified session


Start a packet capture. You must have already configured the packet capture with the set capture session <session-number> interface <port-uuid-name> direction <direction> command.

If you don't specify a file, the output displays on the terminal.

Type Control-C to end the packet capture.

You can filter the capture using tcpdump expressions. The expression must be the last argument of the command.

Use the get capture sessions command to see all configured capture sessions.

set capture session <session-number> [file <filename>] [count <packet-count>] [expression <expression>]

Start packet capture for the specified session


Start a packet capture. You must have already configured the packet capture with the set capture session <session-number> interface <port-uuid-name> direction <direction> command.

If you don't specify a file, the output displays on the terminal.

If file is specified, the file count can be specified to enable rotating capture files, where each file will be of size 100MB. Multiple files will be bundled into single tarfile.

Type Control-C to end the packet capture.

You can filter the capture using tcpdump expressions. The expression must be the last argument of the command.

Use the get capture sessions command to see all configured capture sessions.

set capture session <session-number> [file <filename>] [file-count <file-count>] [count <packet-count>] [expression <expression>]

Monitor a port on a certain core in a packet capture session


Configure a packet capture using the specified interface. You can run this command multiple times to configure multiple interfaces on the same packet capture session. On a LAG interface, LACP packets will also be captured when the direction of packet capture is ingress or dual.

To run the packet capture using this configuration, use the set capture session <session-number> [file <filename>] [count <packet-count>] [expression <expression>] command.

If you need to capture packets from only one interface, you can configure and run the packet capture with a single command: start capture interface <interface-name> [direction <direction>] [file <filename>] [count <packet-count>] [expression <expression>].

Use the get capture sessions command to see all configured capture sessions.

set capture session <session-number> interface <port-uuid-name> direction <capture-direction> [core <core-id>]

Show packet capture on dvfilter


Display a packet capture on a given dvfilter. To get a list of dvfilter names, enter start capture dvfilter followed by a space and the Tab key.
start capture dvfilter <esx-dvfilter-name-arg>

Start packet capture on given interface with multiple options and save to file


Start a packet capture on the specified interface in the given direction and core. If you do not specify a file, the output is displayed on the terminal. If file is specified, the file count can be specified to enable rotating capture files, where each file will be of size 100MB. Multiple files will be bundled into single tarfile. Type Control-C to end the packet capture. You can filter the capture using tcpdump expressions. The expression must be the last argument of the command. The expression is a keyword followed by a value. You can specify multiple keyword-value pairs.
start capture interface <interface-name> [direction <direction>] [core <core-id>] [snaplen <capture-snaplen-arg] [file <filename>] [file-count <file-count>] [expression <expression>]

Start packet capture on given interface with multiple options and save to file


Start a packet capture on the specified interface in the given direction. If you do not specify a file, the output is displayed on the terminal. Type Control-C to end the packet capture. You can filter the capture using tcpdump expressions. The expression must be the last argument of the command. The expression is a keyword followed by a value. You can specify multiple keyword-value pairs. The list of keywords and acceptable values are:

Keyword Value
ethtype Ethernet type in HEX format. 0x<ETHTYPE>
mac Source or destination MAC address
srcmac Source MAC address
dstmac Destination MAC address
ipproto IP protocol in HEX format. 0x<PROTO>
ip Source or destination IPv4 address
ip6 Source or destination IPv6 address
srcip Source IPv4 address
dstip Destination IPv4 address
srcip6 Source IPv6 address
dstip6 Destination IPv6 address
port Source or destination TCP port
srcport Source TCP port
dstport Destination TCP port
srcudpport Source UDP port
dstudpport Destination UDP port
vni VNI of the flow. When specified, the decoding offset for the remainder of the expression changes to the inner packet.
vlan VLAN ID

start capture interface <interface-name> [direction <direction>] [file <filename>] [count <packet-count>] [expression <expression>]

Start packet capture on node with given parameters


Start packet capture in standalone mode with given fcport.
start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given fcport.
start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in steam mode with given fcport.
start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on node with given parameters


Start packet capture in steam mode with given fcport.
start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on node with given filter


Start packet capture in standalone mode with given filter.
start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg>

Start packet capture on node with given filter


Start packet capture in standalone mode with given filter.
start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg> parameters <capture-options-arg>

Start packet capture on node with given filter


Start packet capture in stream mode with given filter.
start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on node with given filter


Start packet capture in stream mode with given filter.
start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given interface.
start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given interface.
start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in stream mode with given interface.
start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on node with given parameters


Start packet capture in stream mode with given interface.
start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given pnic.
start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given pnic.
start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in steam mode with given pnic.
start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on node with given parameters


Start packet capture in steam mode with given pnic.
start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given parameters


Start packet capture in standalone mode with given parameters.
start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg>

Start packet capture on ESXi node with given parameters


Start packet capture in standalone mode with given parameters.
start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given parameters


Start packet capture on ESXi node with given parameters.
start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on ESXi node with given parameters


Start packet capture on ESXi node with given parameters.
start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given vif.
start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg>

Start packet capture on node with given parameters


Start packet capture in standalone mode with given vif.
start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on node with given parameters


Start packet capture in stream mode with given vif.
start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on node with given parameters


Start packet capture in stream mode with given vif.
start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given vmknic


Start packet capture in standalone mode on ESXi node with given vmknic.
start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg>

Start packet capture on ESXi node with given parameters


Start packet capture in standalone mode with given parameters.
start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given vmknic


Start packet capture on ESXi node with given vmknic.
start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on ESXi node with given vmknic


Start packet capture on ESXi node with given vmknic.
start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given vmnic


Start packet capture in standalone mode on ESXi node with given vmnic.
start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg>

Start packet capture on ESXi node with given parameters


Start packet capture in standalone mode with given parameters.
start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given vmnic


Start packet capture on ESXi node with given vmnic.
start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on ESXi node with given vmnic


Start packet capture on ESXi node with given vmnic.
start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given vnic


Start packet capture in standalone mode on ESXi node with given vnic.
start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg>

Start packet capture on ESXi node with given parameters


Start packet capture in standalone mode with given parameters.
start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>

Start packet capture on ESXi node with given vnic


Start packet capture on ESXi node with given vnic.
start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>

Start packet capture on ESXi node with given vnic


Start packet capture on ESXi node with given vnic.
start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>

Show packet capture on all interfaces


Display a packet capture on all available interfaces.
start capture trace

Stop packet capture


Stop packet capture by session id.
stop capture session <session-id-arg>

Total commands: 62