WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud
  • Tanzu
    • Application Modernization
    • Tanzu services
    • Tanzu Community Edition
    • Tanzu Kubernetes Grid
    • vSphere with Tanzu
  • Home Lab
  • Nested Virtualization
  • Apple
You are here: Home / Uncategorized / How to query for MACs on internal vSwitch on ESXi

How to query for MACs on internal vSwitch on ESXi

05.28.2011 by William Lam // 10 Comments

There was an interesting question this week on the VMTN community forums about querying a vSwitch on an ESX(i) host. The user was trying to locate a particular virtual machine's MAC Address due to an IP conflict that was identified. The internal VMware vSwitch is pretty much closed off as a blackbox. The vSwitch is not exposed like a traditional physical switch in which you can run commands against such as "show mac-address-table" to display the MAC addresses found on the switch.

However, you can still perform a lookup of all the MAC Addresses found on a particular ESX(i)/vCenter host by using the vSphere APIs. You can search for all virtual machines and dump out their associated MAC Addresses and correlate that back to a particular vSwitch. You can easily do this through a script such as using the vSphere SDK for Perl script: getvSwitchMacTable.pl which supports both stand vSwitch and distributed vSwitch or if you prefer a GUI, you can use the popular RVTools. I am sure there is most likely a PowerCLI solution to solving this problem as well.

The solution described above is the proper and most flexible way of solving this problem, but what if you really wanted to query the internal vSwitch and extract out the MAC Addresses that way? Well the answer is, you can so using vsish on ESXi (vsish is not available on ESX unless you have the VMware debugging RPM package installed).

Here are some of things you can view for a given vSwitch using vsish:

~ # vsish -e ls /net/portsets/vSwitch0
ports/
overlays/
uplinks/
type
mtu
unlink
link
destroy
properties
stats

The "ports" section is what we are interested in:

~ # vsish -e ls /net/portsets/vSwitch0/ports
16777217/
16777218/
16777219/
16777220/
16777358/
16777359/

When looking at a particular port, it provides quite a bit of information on what is connected and various metrics/statistics:

~ # vsish -e ls /net/portsets/vSwitch0/ports/16777220/
respool/
e1000/
vmxnet3/
pktSizes/
clusterSizes/
worlds/
coalesceDetailed/
ip
schedTeamUplink
teamUplink
blocked
injectIGMP
txCompCoalesce
txCoalesce
rxCoalesce
controlChain
notifyStats
inputStats
outputStats
vmxnet2clientStats
clientStats
gateway
setPassthru
status
stats

As you can see it is pretty tedious to go through each of the ports and it does not easily allow you to figure out what is exactly connected to the port until you view the "status" property.

I decided to write a tiny script that would allow a user to dump out all the MAC Addresses from the vSwitch(s) found on an ESX(i) host. Not only does it provide this mapping but also what is specifically using a given port whether it is mapped to internal interface or a particular virtual machine.

You can download the script vswitchInfo.sh which runs directly on ESXi's TSM (Tech Support Mode). The script can be called with the "-l" option to provide a high level dump of all MAC Addresses. Once you have identified the particular vSwitch and port, then you can get further details by specifying "-v" for vSwitch name and "-p" for the port number as displayed from the previous execution.

Here is an example output of just listing all MAC Addresses from all vSwitch(s) in an ESXi host:

Here is an example of getting more details on a particular port on a vSwitch:

Here you can see the clientName which is either a VM or interface using the port. You will also notice there is a mapping to set of pNICS that are attached to the vSwitch and various other details that I will let you explore.

You might have noticed the vSwitch port-ids looks kind of familiar? If you did, they actually are, as they part of the "networking" section in esxtop/resxtop output.

Unfortunately with esxtop/resxtop, it does not display the associated MAC Addresses, but now you have a way to easily query for details on the internal ports of a vSwitch.

Note: The second solution falls under the "not supported" category as you might have guessed.

More from my site

  • How to mount a cdrom using vsish on ESXi
  • Quick Tip - Using ESXi to send Wake-on-Lan (WoL) packet
  • Verify Hypervisor-Assisted Guest Mitigation (Spectre) patches using PowerCLI
  • How to clear the ARP cache in ESXi prior to vSphere 5.5
  • What's New in VMware Vsish for ESXi 5.1

Categories // Uncategorized Tags // esxi4.1, vsish, vswitch

Comments

  1. Jalal Araidah says

    12/27/2011 at 9:38 pm

    Nice article.

    But does this 'vswitchInfo.sh' script work on ESXi 5.0??

    TIA

    Reply
  2. William says

    12/27/2011 at 10:45 pm

    @Jalal,

    Yes the output was actually from an ESXi 5 host, this should work on all version of ESX(i).

    Reply
  3. Anonymous says

    11/24/2012 at 3:15 pm

    is there a way to view statistics per port group, rx/tx?
    thanks.

    Reply
  4. Adam Thompson says

    01/04/2013 at 8:57 pm

    I needed a way to find out the name of the port group, since "vSwitch2" doesn't mean much to a human. Finally found it in /net/portSets/*/ports/*/status under "portCfg:". Argh. Modified script to display that critical piece of information. Diff emailed to info.virtuallyghetto at gmail.

    Reply
  5. SGK says

    02/10/2016 at 10:18 pm

    William,
    Nice script!! But I am not able to download it. Can you please check?

    Reply
  6. Jean-Claude De Blois says

    06/06/2016 at 8:46 am

    Great work....that script saved me a lot of work. Thanks for sharing it.

    Reply
  7. gsmid says

    07/07/2017 at 2:30 pm

    Is this script still available? I can't find it in your new GitHub repo... :'o(

    Reply
    • William Lam says

      07/07/2017 at 2:33 pm

      Yes, I've just updated the link above. You can find all my scripts here https://github.com/lamw/ 🙂

      Reply
  8. Djdylan says

    06/11/2021 at 9:13 am

    What about "forged" mac addresses [i.e. coming from a VM]. are you able to gather to which those mac addresses are coming from?

    Reply

Trackbacks

  1. NSX Exploration: On maps and territories says:
    12/17/2017 at 7:01 pm

    […] How to query for MACs on internal vSwitch on ESXi […]

    Reply

Thanks for the comment! Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search

Author

William Lam is a Senior Staff Solution Architect working in the VMware Cloud team within the Cloud Infrastructure Business Group (CIBG) at VMware. He focuses on Cloud Native technologies, Automation, Integration and Operation for the VMware Cloud based Software Defined Datacenters (SDDC)

Connect

  • Email
  • GitHub
  • LinkedIn
  • RSS
  • Twitter
  • Vimeo

Recent

  • Self-Contained & Automated VMware Cloud Foundation (VCF) deployment using new VLC Holodeck Toolkit 03/29/2023
  • ESXi configstorecli enhancement in vSphere 8.0 Update 1 03/28/2023
  • ESXi on Intel NUC 13 Pro (Arena Canyon) 03/27/2023
  • Quick Tip - Enabling ESXi Coredumps to be stored on USB 03/26/2023
  • How to disable the Efficiency Cores (E-cores) on an Intel NUC? 03/24/2023

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2023