pktcap-uw

In the Ultra Transcenders books

2V0-16.252V0-15.252V0-18.25

Each book explains pktcap-uw in context, with comparison tables and the common traps.

Terms in this definition

• Packet capture

  Network Watcher feature that records a VM's traffic, filtered by 5-tuple and bounded by a time limit (18,000 seconds, or 5 hours, by default). It depends on the Network Watcher Agent extension.

• ESX

  VMware's bare-metal hypervisor, installed on each host in a VCF fleet. Up to version 9.0 it was known as ESXi.

• Temporary Access Pass

  A Microsoft Entra ID passcode valid for a limited time, used to onboard users or recover accounts. Its value can be viewed only when it is first created.

• PATH

  Parent-child hierarchies in DAX rely on this function. For each row it builds one delimited text value listing the IDs of the row's ancestors, top level first and ending with the row's own ID, which PATHITEM, PATHLENGTH and friends can then pick apart.

• Physical

  Describes the concrete, real-world parts that put a logical architecture into effect.

• NIC

  Network interface card, the network interface of a VM; NSGs can be associated with it.

• SWITCH

  Checks one expression against several candidate values, returning whichever result pairs with the match (or a fallback otherwise). Writing SWITCH ( TRUE (), ... ) avoids nested IF chains: whichever condition is first true wins.

• VMkernel adapter

  An ESX host's own virtual network interface, named vmk0, vmk1 and so forth. It handles host services like management, vMotion, vSAN and IP storage, as opposed to traffic from VMs.

Related terms

• Enhanced Networking Stack

  A vSphere Distributed Switch mode for ESX hosts. Packet captures with pktcap-uw on its ports cannot use the --rcf filter.

• PCAP

  Capture files in this format come from packet-capture tools like pktcap-uw and NSX Live Traffic Analysis, and Wireshark opens them. Stale ones may fill up space on NSX Manager.