Note: These expressions are the same onces you can use to filter traffic when running nstrace from the GUI. Start nstrace -filter “SRCIP = x.x.x.x & DESTPORT = xx” – Captures traffic from a specified source IP and a specified destination port. Start nstrace -filter “DESTPORT = 443” – Captures traffic where the destination port is 443. Start nstrace -filter “SRCIP = x.x.x.x” – Captures traffic sent from source IP. Start nstrace -filter “DESTIP = x.x.x.x” – Captures all traffic to destination IP.

The -link ENABLE switch is used to capture return traffic from 192.168.0.242. Start nstrace -filter “DESTIP = 192.168.0.242” -link ENABLE – Captures all traffic to destination IP 192.168.0.242. size 0 means all packets are captured regardless of packet size. Start nstrace -size 0 -filter “svcname = xx” – Captures traffic to and from the specified service. Start nstrace -filter “vsvrname = LDAP-LoadBalanced-vServer” – Captures traffic to and from the specified vServer. Show nstrace – Shows the status of nstrace and if it is running etc. This allows you to only capture traffic of interest. You can use specific filters in WireShark as normal to filter through captured data or specify filters using the NetScaler CLI.

Nstrace dumps packets in the native NetScaler format. Nstrace is a NetScaler packet capture tool.

Wireshark display filter lldp