In a network virtualization architecture using NSX-T, virtual machines (like VM-1) generate standard, unencapsulated traffic. When this traffic needs to traverse an Overlay-Segment to reach a VM on another host (VM-2), the source host's hypervisor encapsulates the original frame at the Tunnel Endpoint (TEP). This process adds an outer IP, UDP, and GENEVE header. To observe this fully encapsulated GENEVE packet using a protocol analyzer like Wireshark, the capture must be performed on the physical uplink interface (vmnic0) as the packet exits the host toward the physical datacenter fabric. Capturing at the VM's vNIC would only yield the unencapsulated inner payload.

VMware Docs: VMware NSX-T Data Center Administration Guide, "Packet Capture and Network Troubleshooting". Sections detailing pktcap-uw usage specify that capturing on the physical uplink (vmnic) is required to view the outer encapsulation headers (GENEVE/UDP/IP) before traffic enters the physical fabric.

IETF RFC 8926: "Geneve: Generic Network Virtualization Encapsulation", Section 3.1 (Encapsulation over IPv4/IPv6) and Section 4.1 (Transit Devices). DOI: 10.17487/RFC8926. This defines how the inner payload is encapsulated by the tunnel endpoint and transmitted over the physical transit infrastructure.