https://vlan51.com/tags/packet-capture/Recent content in Packet-Capture on vlan51Hugoen-gbThu, 01 Oct 2015 00:00:00 +0000https://vlan51.com/netscaler/packet-capture-nstrace/Thu, 01 Oct 2015 00:00:00 +0000https://vlan51.com/netscaler/packet-capture-nstrace/<p>How to capture packets on a Citrix NetScaler from the command line using <code>nstrace</code>, then open the capture in Wireshark.</p> <h2 id="start-a-capture">Start a capture <a class="anchor" href="#start-a-capture" aria-label="Link to this section">#</a></h2> <p>SSH to the NetScaler and, at the <code>&gt;</code> prompt, run <code>nstrace</code> with a filter:</p> <div class="code"> <div class="code-bar"><span>cli</span><button class="copy" type="button" aria-label="Copy to clipboard">Copy</button></div><pre><code>nstrace -filter &#34;DESTIP == 10.0.0.20&#34; -link ENABLED -size 0</code></pre></div> <p><code>-size 0</code> captures the entire packet. By default NetScaler only captures the headers.</p> <p>To combine filters, put the whole expression in quotes and separate conditions with <code>||</code> (or <code>&amp;&amp;</code>):</p>