<root
    
    Packet Capture and Trace command usage:
    	== Create session to capture packets == 
    	 pktcap-uw [--capture [,capture point]...
    	      | [--dir <0|input|1|output|2|inputAndOutput>] 
    	        [--stage <0|pre|1|post>] [-K|--kernelside]]
    	    [--switchport  | --vmk  | --uplink  |
    	       --fcport [fastpathSwitchID.] |
    	       --dvfilter  |
    	       --overlay ]
    	    [--lifID ]
    	    [-f [module name.][:offset]]
    	    [-AFhP] [-p|--port ]
    	    [-c|--count ] [-s|--snapLen ]
    	    [-G ]
    	    [-C ]
    	    [-o|--outfile ] [--console]
    	    [Flow filter options]
    	== Create session to trace packets path == 
         it can trace up to 32 level from pkt allocation and record up to 12 IOChain or portID 
    	 pktcap-uw --trace
    	    [-AFhP] [-p|--port ]
    	    [-c|--count ] [-s|--snapLen ]
    	    [-G ]
    	    [-C ]
    	    [-o|--outfile ] [--console]
    	    [Flow filter options]
    The command options:
    	-p, --port 
    		Specify the port number of vsocket server.
    	-G, 
    		Specify the seconds to rotate the outfile.
    	-C, 
    	-o, --outfile 
    		Specify the file name to dump the packets. If unset, 
    		output to console by default. If '-', then stdout is used.
    	-P, --ng   (only working with '-o')
    		Using the pcapng format to dump into the file.
    	--console  (by default if without '-o')
    		Output the captured packet info to console.
    	-s, --snaplen 
    		Only capture the first  packet buffer.
    		The minimum snap length is 24 bytes. However, setting 
    		snaplen to 0 will capture entire packet.
    	-c, --count 
    		How many count packets to capture.
    	-h
    		Print this help.
    	-A, --availpoints
    		List all capture points supported.
    	-F 
    		List all dynamic capture point functions supported.
    	-4
    		Capture only IPv4 Packet.
    	-6
    		Capture only IPv6 Packet.
    	--capture 
    		Specify the capture point. Use '-A' to get the list.
    		If not specified, will select the capture point
    		by --dir and --stage setting
    The switch port options:
    (for Port, Uplink and Etherswitch related capture points)
    	--switchport 
    		Specify the switch port by ID
    	--fcport [fastpathSwitchID.]
    		Specify the fastpath port by ID
    	--lifID 
    		Specify the logical interface id of VDR port
    	--vmk 
    		Specify the switch port by vmk NIC
    	--uplink 
    		Specify the switch port by vmnic
    The capture point auto selection options without --capture:
    	--dir <0|input|1|output|2|inputAndOutput>  (for --switchport, --vmk, --uplink, --fcport)
    		The direction of flow, with respect to the vswitch:
    		0- Input: to vswitch (Default), 1- Output: from vswitch, 2- Input and Output
    	--stage <0|pre|1|post>  (for --switchport, --vmk, --uplink, --dvfilter, --overlay)
    		The stage at which to capture: 0- Pre: before, 1- Post: after
    	--kernelside (for --uplink)
    		The capture point is in kernel instead of in driver.
    		This option is always true and no longer required.
    The capture point options
    	-f [module name.][[:offset]|[:line number]]
    		The function name and the offset/line number in the function.
    		The default module name is 'vmkernel'.
    		The default offset into the function is 0 (the beginning of the function).
    		The line number must start with letter 'L' if it's file related
    		line number, or 'F' for function related line number.
    		(for 'Dynamic', 'IOChain' and 'TcpipDispatch' capture points)
    	--dvfilter 
    		Specify the dvfilter name for DVFilter related points
    	--overlay 
    		Specify the overlay class name for 'Overlay' capture point
    	--pkt-list-param-idx 
    		Specify the pktList index in function's parameter table, starting from 1
    	--pkt-param-idx 
    		Specify the pkt index in function's parameter table, starting from 1
    	--port-id-param-idx 
    		Specify the portId index in function's parameter table, starting from 1
    		--switchport option is required to filter packets by port ID
    	--mbuf-param-idx 
    		Specify the mbuf index in function's parameter table, starting from 1
    	--mbuf-array-param-idx 
    		Specify the mbuf array index in function's parameter table, starting from 1
    	--num-mbufs-param-idx 
    		Specify the mbuf array size index in function's parameter table, starting from 1
    	--vprobe-pkt-list 
    		If function offset is specified in '-f' argument, this is the vprobe
    		expression to access the pointer to pktList, e.g. "rax+18"
    		If file/function relative line number is specified in '-f' argument,
    		this is the C expresstion to access pktList, all variables must start
    		with '$' sign, e.g. "$pktListPtr"
    	--vprobe-pkt 
    		Vprobe/C expression to access the pointer to pkt, e.g. "rax+18"
    		or "$pkt", see argument --vprobe-pkt-list for details.
    	--vprobe-port-id 
    		Vprobe/C expression to access switch port id, e.g. "rax+18"
    		or "$portID", see argument --vprobe-pkt-list for details.
    	--vprobe-mbuf 
    		Vprobe expression to access mbuf, e.g. "rax+18"
    		or "$mbufPtr", see argument --vprobe-pkt-list for details.
    	--vprobe-mbuf-array 
    		Vprobe expression to access mbuf array, e.g. "rax+18"
    		or "$mbufArray", see argument --vprobe-pkt-list for details.
    	--vprobe-num-mbufs 
    		Vprobe expression to access number of mbufs in the array, e.g. "rax+18"
    		or "$numMbufs", see argument --vprobe-pkt-list for details.
    	--vprobe-symdbs 
    		The parent directory of the symbol database.
    	--no-vprobe
    		Don't emit vprobe script to assist packet capture, the capture
    		function itself has dynamic capture point inserted
    	--compile-only
    		Print the vprobe script to standard output and exit
    	--script 
    		Start vprobe with the input .emt file to filter packets
    Flow filter options, it will be applied when set:
    	--srcmac 
    		The Ethernet source MAC address.
    	--dstmac 
    		The Ethernet destination MAC address.
    	--mac 
    		The Ethernet MAC address(src or dst).
    	--ethtype 0x
    		The Ethernet type. HEX format.
    	--vlan 
    		The Ethernet VLAN ID, one of 0-4095.
    	--srcip ]>
    		The source IPv4/IPv6 address.
    	--dstip ]>
    		The destination IPv4/IPv6 address.
    	--ip 
    		The IPv4/IPv6 address(src or dst).
    	--proto 0x
    		The IPv4/IPv6 protocol.
    	--srcport 
    		The TCP source port.
    	--dstport 
    		The TCP destination port.
    	--tcpport 
    		The TCP port(src or dst).
    	--srcudpport 
    		The UDP source port.
    	--dstudpport 
    		The UDP destination port.
    	--udpport 
    		The UDP port(src or dst).
    	--vni 
    		The VNI of flow, one of 0-16777215.
    	--vxlan 
    		The vxlan id of flow. This option is depreciated, use 'vni' instead.
    
    



Designed by SanjuD(@ngineerbabu)