can wireshark capture packets from another network vmware

In vSphere 6.7 and later you can use -dir 2 to capture traffic in both directions at once. This results in two separate capture files, but these can easily be merged in Wireshark. The examples below are for vSphere 5.5 - 6.5 and will start two traces, one using -dir 0 for inbound traffic and and one using -dir 1 for outbound traffic. In most cases you’ll probably want to capture traffic in both directions. The first thing to note is that pktcap-uw only captures inbound traffic by default. VMware has a nice overview in the KB article Using the pktcap-uw tool in ESXi 5.5 and later (2051814). If you want or need to capture traffic on the ESXi host, then pktcap-uw is your tool.

A fellow blogger has published a great article on using ERSPAN: vSphere Distributed Virtual Switch: Packet analysis using ERSPAN. If you only need to capture traffic for a specific VM or virtual port and are using a vSphere Distributed Switch (VDS) I’d recommend looking into the port mirroring options available on the VDS ( Official VMware Docs - Working With Port Mirroring), and specifically ERSPAN. This article shares some notes I took on packet captures (specifically using pktcap-uw) and challenges I ran into recently while troubleshooting the boot up and DHCP process for some VMs.

Can wireshark capture packets from another network vmware