10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

JGSPIERS.COM (HTTP://WWW.JGSPIERS.COM)
Citrix & Unidesk Application and Desktop delivery

Citrix NetScaler trac capture using nstrace

and nstcpdump
(http://www.jgspiers.com/citrix-netscalertrac-capture-using-nstrace-nstcpdump/)
Mar 30, 2016 /

XenApp/XenDesktop (http://www.jgspiers.com/category/xenapp-xendesktop/)

Nstrace
Nstrace is a NetScaler packet capture tool. Nstrace dumps packets in the native NetScaler
format. These trace les have an extension of .cap and can be analysed with WireShark. You can
use specic lters in WireShark as normal to lter through captured data or specify lters using
the NetScaler CLI. This allows you to only capture trac of interest.

start nstrace Captures all trac.

stop nstrace Stops the packet capture.
show nstrace Shows the status of nstrace and if it is running etc.

start nstrace -lter vsvrname == LDAP-LoadBalanced-vServer Captures trac to and from the
specied vServer.

http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

1/7

10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

start nstrace -lter svcname == xx Captures trac to and from the specied service.
start nstrace -lter DESTIP == 192.168.0.242 -link ENABLE Captures all trac to destination IP
192.168.0.242. The -link ENABLE switch is used to capture return trac from 192.168.0.242.

start nstrace -lter DESTIP == x.x.x.x Captures all trac to destination IP.
start nstrace -lter SRCIP == x.x.x.x Captures trac sent from source IP.
start nstrace -lter DESTPORT == 443 Captures trac where the destination port is 443.

start nstrace -lter SRCIP == x.x.x.x && DESTPORT == xx Captures trac from a specied
source IP and a specied destination port.

Nstcpdump
Nstcpdump can be used for more low-level troubleshooting. Nstcpdump does not collect as
much detailed information as nstrace. Open NetScaler CLI and type shell. You can use lters
with nstcpdump but cannot use lters specic to NetScaler resources. The dump output can be
viewed directly within the CLI screen.
http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

2/7

10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

CTRL + C Press these keys simultaneously to stop an nstcpdump.

nstcpdump.sh dst host x.x.x.x Shows trac sent to the destination host .
nstcpdump.sh -c 10 dst host 192.168.0.242 Outputs the rst 10 packets from destination
192.168.0.242.

nstcpdump.sh dst host 192.168.0.242 and port 443 Outputs trac destined for 192.168.0.242
on port 443.

nstcpdump.sh src host x.x.x.x and port xx Outputs trac from specied source IP and
specied port .

nstcpdump.sh icmp Outputs all sent and replied echo requests. NetScaler uses ICMP to track
up/down status of DNS servers congured on NetScaler for example.

http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

3/7

10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

nstcpdump.sh icmp and dst host x.x.x.x Outputs all sent echo requests to a specied
destination host.

Tags: citrix (http://www.jgspiers.com/tag/citrix/), netscaler

(http://www.jgspiers.com/tag/netscaler/), nstcpdump
(http://www.jgspiers.com/tag/nstcpdump/), nstrace (http://www.jgspiers.com/tag/nstrace/),
packet trace (http://www.jgspiers.com/tag/packet-trace/)

LEAVE A REPLY

Write your comment...

Name (Required)

Email (Optional)

http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

4/7

10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

POST COMMENT

SEARCH SITE

Search and hit enter...

CATEGORIES
NetScaler (http://www.jgspiers.com/category/netscaler/)
News (http://www.jgspiers.com/category/news/)
Provisioning Services (http://www.jgspiers.com/category/provisioningservices/)
Receiver (http://www.jgspiers.com/category/receiver/)
XenApp/XenDesktop (http://www.jgspiers.com/category/xenapp-xendesktop/)

SUBSCRIBE TO BLOG

Receive email alerts when new posts are published

Name

Email *

SUBSCRIBE

http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

5/7

10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

RECENT POSTS
Citrix Workspace Environment Manager (http://www.jgspiers.com/citrix-workspace-environmentmanager/)
Add Citrix applications to Start Menu and Desktop (http://www.jgspiers.com/add-citrix-applicationsstart-menu-desktop/)
Skype for Business with XenApp & XenDesktop (http://www.jgspiers.com/skype-for-businessxenapp-xendesktop/)

RECENT COMMENTS
George Spiers on Citrix ThinWire HDX Graphics Modes what is right for you?
(http://www.jgspiers.com/citrix-thinwire-hdx-graphics-modes-what-is-right-for-you/#comment-175)
Rasmus Raun-Nielsen on Citrix ThinWire HDX Graphics Modes what is right for you?
(http://www.jgspiers.com/citrix-thinwire-hdx-graphics-modes-what-is-right-for-you/#comment-174)
George Spiers on User stuck on Citrix Desktop, no way to force log o
(http://www.jgspiers.com/user-stuck-citrix-desktop-force-log-o/#comment-165)

ARCHIVES
October 2016 (http://www.jgspiers.com/2016/10/)(3)
September 2016 (http://www.jgspiers.com/2016/09/)(4)
August 2016 (http://www.jgspiers.com/2016/08/)(9)
July 2016 (http://www.jgspiers.com/2016/07/)(7)
June 2016 (http://www.jgspiers.com/2016/06/)(3)
May 2016 (http://www.jgspiers.com/2016/05/)(9)
April 2016 (http://www.jgspiers.com/2016/04/)(6)
March 2016 (http://www.jgspiers.com/2016/03/)(5)
http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

6/7

10/17/2016

CitrixNetScalertrafficcaptureusingnstraceandnstcpdumpJGSpiers.com

February 2016 (http://www.jgspiers.com/2016/02/)(8)

January 2016 (http://www.jgspiers.com/2016/01/)(9)
December 2015 (http://www.jgspiers.com/2015/12/)(3)
November 2015 (http://www.jgspiers.com/2015/11/)(2)
October 2015 (http://www.jgspiers.com/2015/10/)(1)
September 2015 (http://www.jgspiers.com/2015/09/)(9)
August 2015 (http://www.jgspiers.com/2015/08/)(10)
July 2015 (http://www.jgspiers.com/2015/07/)(6)

Copyright JGSpiers.com

http://www.jgspiers.com/citrixnetscalertrafficcaptureusingnstracenstcpdump/

7/7