Sniffing Packets on VMware ESXi 5.1 and Viewing the Capture in Wireshark – Note: replace the IP address with your storage controller hostname or IP. I’ll post that soon.ġ) Login to the Splunk UI, click Search to launch the Search app, enter the string below and the results will be displayed. I won’t go into the Splunk configuration in this post. You can download and use it for free up to 500 Megs a day indexed. Assuming your NetApp storage (or any vendor) is configured to send syslog to Splunk, you can easily find the event.

You can clearly see on the right in the Info column, packet 856 is an Authentication Failure packet.Īnother way to see the authentication failure is with Splunk. > tcpdump-uw -i vmk1 -s 1514 -w esxihost01.pcapĪ) When done, in vCenter select the ESXi host you were sniffing packets on, then click the Configuration tab > Storage.ī) Right-click datastore1 (or the datastore were your pcap file is) and select Browse datastore.Ĭ) Click download a file > select the location and click OK.ĭ) Double-click the file and it will open in Wireshark.Į) In Wireshark, in the upper left, enter in the Filter: field and click Apply. Before you start the capture, change directories so you can easily recover the pcap file from the datastore in vCenter. Say you need to isolate traffic to troubleshoot iSCSI CHAP session negotiation failures between ESXi and NetApp storage.ġ) Dump the traffic to a pcap file and open it with Wireshark.

This is a companion post to sniffing packets in ESXi I posted here.

Wireshark download ubuntu 18.04