tcpdump tcp-dump-uw

ESX tcpdump

•  -s 1514 (normal traffic) 9014 (Jumbo Frame)
• -i interface (VM NIC, kernel port nic, console nic)
  
• -w outfile for other network traffic analyzer (traffic.pcap for WireShark )
• promiscuous mode accept at security settings from Switch, port group, and VMs' NIC

ESXi tcpdump-uw

• -s 1514 (normal traffic) 9014 (Jumbo Frame)
• -i interface (VM NIC, kernel port nic, console nic)
  
• -w outfile for other network traffic analyzer (traffic.pcap for WireShark )

Wirehark is similar to tcpdump, but has a graphicl front-end,, plus some sorting and filtering options