Command-Line Packet Capture on Citrix NetScaler with nstrace

Thu, 01 Oct 2015 00:00:00 +0000

How to capture packets on a Citrix NetScaler from the command line using nstrace, then open the capture in Wireshark.

Start a capture #

SSH to the NetScaler and, at the > prompt, run nstrace with a filter:

cli

nstrace -filter "DESTIP == 10.0.0.20" -link ENABLED -size 0

-size 0 captures the entire packet. By default NetScaler only captures the headers.

To combine filters, put the whole expression in quotes and separate conditions with || (or &&):

Restricting SMTP Access with ACLs on Citrix NetScaler

Thu, 01 Oct 2015 00:00:00 +0000

I had to configure a Citrix NetScaler (version 10.5) to load balance SMTP for an organisation that relayed mail through Microsoft’s smart host. Only specific source IP addresses should be able to reach port 25.

This is all done from the CLI. In the GUI, the same settings are under Configuration → System → Network → ACLs.

In this example, the permitted senders are 1.1.1.1 and 2.2.2.2.

Create the ACLs #

cli

> add ns acl ALLOW-SMTP-1.1.1.1 ALLOW -srcIP = 1.1.1.1 -destPort = 25 -protocol TCP -priority 10
 Done
> add ns acl ALLOW-SMTP-2.2.2.2 ALLOW -srcIP = 2.2.2.2 -destPort = 25 -protocol TCP -priority 20
 Done
> add ns acl RESTRICT-SMTP-ALL DENY -srcIP = 0.0.0.0-* -destPort = 25 -protocol TCP -priority 50
 Done

There’s no implicit deny or permit at the end of a NetScaler ACL list, so you need the explicit DENY rule to block everyone else. Lower priority numbers are evaluated first.

Citrix on vlan51

Command-Line Packet Capture on Citrix NetScaler with nstrace

Start a capture #

Restricting SMTP Access with ACLs on Citrix NetScaler

Create the ACLs #