Command-Line Packet Capture on Citrix NetScaler with nstrace

How to capture packets on a Citrix NetScaler from the command line using nstrace, then open the capture in Wireshark.

Start a capture #

SSH to the NetScaler and, at the > prompt, run nstrace with a filter:

cli

nstrace -filter "DESTIP == 10.0.0.20" -link ENABLED -size 0

-size 0 captures the entire packet. By default NetScaler only captures the headers.

To combine filters, put the whole expression in quotes and separate conditions with || (or &&):

cli

nstrace -filter "DESTIP == 10.0.0.20 || DESTPORT == 25" -link ENABLED -size 0

Find the trace file #

Captures are written to /var/nstrace, named nstrace1.cap, nstrace2.cap and so on. Drop into the shell to see them:

cli

> shell
root@NS-TEST101# ls -las /var/nstrace/
 304384 -rw-r--r--   1 root  wheel  311508992 Oct  5 12:18 nstrace1.cap
  65888 -rw-r--r--   1 root  wheel   67395584 Oct  6 11:41 nstrace2.cap
  56352 -rw-r--r--   1 root  wheel   57655296 Oct  6 12:05 nstrace3.cap

Copy the file off with WinSCP (or scp) and open it in Wireshark.

Use tcpdump format instead #

NetScaler writes its own variant of the capture format by default, which older versions of Wireshark can’t read. On NetScaler 10.5 I used this to write tcpdump format instead:

cli

nstrace -filter "DESTIP == 10.0.0.150 || DESTPORT == 25" -link ENABLED -size 0 -tcpDump TCPDUMP

On newer firmware, check nstrace -help for the -traceformat option.

If you’re comfortable with tcpdump, it’s also available directly in the NetScaler shell.

For the full option list, see Citrix’s nstrace articles: CTX120941 (version 9) and CTX132384 (version 10).