The -link ENABLE switch is used to capture return traffic from 192.168.0.242. Start nstrace -filter “DESTIP = 192.168.0.242” -link ENABLE – Captures all traffic to destination IP 192.168.0.242. size 0 means all packets are captured regardless of packet size. Start nstrace -size 0 -filter “svcname = xx” – Captures traffic to and from the specified service.

Start nstrace -filter “vsvrname = LDAP-LoadBalanced-vServer” – Captures traffic to and from the specified vServer. Show nstrace – Shows the status of nstrace and if it is running etc. This allows you to only capture traffic of interest.

You can use specific filters in WireShark as normal to filter through captured data or specify filters using the NetScaler CLI. Nstrace dumps packets in the native NetScaler format. Setting up this column in Wireshark is useful when looking at HTTPS traffic and filtering on _server_name.Nstrace is a NetScaler packet capture tool. This works for normal HTTPS traffic, such as the type you might find while web browsing. Use _server_name in the filter if you want to see server names for the HTTPS traffic. You can hide or display (or completely remove) colums from the Wireshark display by right-clicking on the bar with the column headers as shown below. I've illustrated this in the image below: Step 3) Right click on that field, and select 'Apply as Column' from the pop-up menu.Step 2) Go to Extension: server_name -> Server Name Indication extension -> Server Name:.Step 1) Follow a TCP stream for HTTPS traffic over port 443 from the pcap.This is how I display a column for _server_name, which is helpful for showing servers using HTTPS from a pcap in your Wireshark display. At the very least, you should be familiar with adding columns to Wireshark, which I covered in that blog post. NOTE: I have an updated version of this information posted on the Palo Alto Networks blog at:īefore doing this, you should've already set up your Wirshark column display as shown shown here. ADDING HTTPS SERVER NAMES TO THE COLUMN DISPLAY IN WIRESHARK

Wireshark filter port 443