nstrace¶
The following operations can be performed on "nstrace":
start nstrace¶
Start NetScaler packet capture tool.
Synopsys¶
start nstrace [-nf <positive_integer>] [-time <positive_integer> | -filesize <positive_integer>] [-size <positive_integer>] [-mode <mode> ...] [-perNIC ( ENABLED | DISABLED )] [-fileName <string>] [-fileId <string>] [-filter <expression>] [-link ( ENABLED | DISABLED )] [-nodes <positive_integer> ...] [-traceformat ( NSCAP | PCAP )] [-merge <merge>] [-doruntimecleanup ( ENABLED | DISABLED )] [-traceBuffers <positive_integer>] [-skipRPC ( ENABLED | DISABLED )] [-inMemoryTrace ( ENABLED | DISABLED )]
Arguments¶
nf
Number of files to be generated in cycle.
Default value: 24
Minimum value: 1
Maximum value: 100
time
Time per file (sec).
Default value: 3600
Minimum value: 1
size
Size of the captured data. Set 0 for full packet trace.
Default value: 164
Minimum value: 0
Maximum value: 1514
mode
Capturing mode for trace. Mode can be any of the following values or combination of these values:
RX Received packets before NIC pipelining (Filter does not work when RX capturing mode is ON)
NEW_RX Received packets after NIC pipelining
TX Transmitted packets
TXB Packets buffered for transmission
IPV6 Translated IPv6 packets
C2C Capture C2C message
NS_FR_TX TX/TXB packets are not captured in flow receiver.
SSLPLAIN Decrypted SSL packets
MPTCP MPTCP master flow
Default mode: NEW_RX TXB
Default value: DEFAULT_MODE
perNIC
Use separate trace files for each interface. Works only with tcpdump format.
Possible values: ENABLED, DISABLED
Default value: DISABLED
fileName
Name of the trace file.
fileId
ID for the trace file name for uniqueness. Should be used only with -name option.
filter
Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format:
<expression> [<relop> <expression>]
<relop> = ( && | || )
nstrace supports two types of filter expressions:
Classic Expressions:
[Note: Classic Expressions are not supported in non-default partitions]
<expression> = the expression string in the format:
<qualifier> <operator> <qualifier-value>
<qualifier> = SOURCEIP.
<qualifier-value> = A valid IP address
<qualifier> = SOURCEPORT.
<qualifier-value> = A valid port number.
<qualifier> = DESTIP.
<qualifier-value> = A valid IP address.
<qualifier> = DESTPORT.
<qualifier-value> = A valid port number.
<qualifier> = IP.
<qualifier-value> = A valid IP address.
<qualifier> = PORT.
<qualifier-value> = A valid port number.
<qualifier> = SVCNAME.
<qualifier-value> = The name of a service.
<qualifier> = VSVRNAME.
<qualifier-value> = The name of a vserver.
<qualifier> = CONNID
<qualifier-value> = A valid PCB dev number.
<qualifier> = VLAN
<qualifier-value> = A valid VLAN ID.
<qualifier> = INTF
<qualifier-value> = A valid interface id in the form of x/y
(n/x/y in case of cluster interface).
<operator> = ( == | eq | != | neq | > | gt
| < | lt | >= | ge | <= | le | BETWEEN )
eg: start nstrace -filter "SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80)"
The filter expression should be given in double quotes.
Default Expressions:
<expression> =:
CONNECTION.<qualifier>.<qualifier-method>.(<qualifier-value>)
<qualifier> = SRCIP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.SRCIP.EQ(127.0.0.1)
<qualifier> = DSTIP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.DSTIP.EQ(127.0.0.1)
<qualifier> = IP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.IP.EQ(127.0.0.1)
<qualifier> = SRCIPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1)
<qualifier> = DSTIPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1)
<qualifier> = IPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1)
<qualifier> = SRCPORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.SRCPORT.EQ(80)
<qualifier> = DSTPORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.DSTPORT.EQ(80)
<qualifier> = PORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.PORT.EQ(80)
<qualifier> = VLANID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid VLAN ID.
example = CONNECTION.VLANID.EQ(0)
<qualifier> = CONNID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid PCB dev number.
example = CONNECTION.CONNID.EQ(0)
<qualifier> = PPEID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid core ID.
example = CONNECTION.PPEID.EQ(0)
<qualifier> = SVCNAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = A valid text string.
example = CONNECTION.SVCNAME.EQ("name")
<qualifier> = LB_VSERVER.NAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = LB vserver name.
example = CONNECTION.LB_VSERVER.NAME.EQ("name")
<qualifier> = CS_VSERVER.NAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = CS vserver name.
example = CONNECTION.CS_VSERVER.NAME.EQ("name")
<qualifier> = INTF
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid interface id in the
form of x/y.
example = CONNECTION.INTF.EQ("x/y")
<qualifier> = SERVICE_TYPE
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = ( SVC_HTTP | FTP | TCP | UDP | SSL |
SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS |
RPCCLNT | SVC_DNS | ADNS | SNMP | RTSP | DHCPRA | ANY|
MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP |
SVC_MYSQL | SVC_MSSQL | SERVICE_UNKNOWN )
example = CONNECTION.SERVICE_TYPE.EQ(ANY)
<qualifier> = TRAFFIC_DOMAIN_ID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid traffic domain ID.
example = CONNECTION.TRAFFIC_DOMAIN_ID.EQ(0)
eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))"
The filter expression should be given in double quotes.
common use cases:
Trace capturing full sized traffic from/to ip 10.102.44.111, excluding loopback traffic
start nstrace -size 0 -filter "CONNECTION.IP.NE(127.0.0.1) && CONNECTION.IP.EQ(10.102.44.111)"
Trace capturing all traffic to (terminating at) port 80 or 443
start nstrace -size 0 -filter "CONNECTION.DSTPORT.EQ(443) || CONNECTION.DSTPORT.EQ(80)"
Trace capturing all backend traffic specific to service service1 along with corresponding client side traffic
start nstrace -size 0 -filter "CONNECTION.SVCNAME.EQ("service1")" -link ENABLED
Trace capturing all traffic through NS interface 1/1
start nstrace -filter "CONNECTION.INTF.EQ("1/1")"
Trace capturing all traffic specific through vlan 2
start nstrace -filter "CONNECTION.VLANID.EQ(2)"
Trace capturing all frontend (client side) traffic specific to lb vserver vserver1 along with corresponding server side traffic
start nstrace -size 0 -filter "CONNECTION.LB_VSERVER.NAME.EQ("vserver1")" -link ENABLED
link
Includes filtered connection's peer traffic.
Possible values: ENABLED, DISABLED
Default value: DISABLED
nodes
Nodes on which tracing is started.
Minimum value: 0
Maximum value: 32
filesize
File size, in MB, treshold for rollover.
Default value: 0
Minimum value: 0
Maximum value: 65536
traceformat
Format in which trace will be generated
Possible values: NSCAP, PCAP
Default value: 0
merge
Specify how traces across PE's are merged
Possible values: ONSTOP, ONTHEFLY, NOMERGE
Default value: 0
doruntimecleanup
Enable or disable runtime temp file cleanup
Possible values: ENABLED, DISABLED
Default value: ENABLED
traceBuffers
Number of 16KB trace buffers
Default value: 5000
Minimum value: 1000
skipRPC
skip RPC packets
Possible values: ENABLED, DISABLED
Default value: DISABLED
inMemoryTrace
Logs packets in appliance's memory and dumps the trace file on stopping the nstrace operation
Possible values: ENABLED, DISABLED
Default value: DISABLED
Example¶
start nstrace -time 10
stop nstrace¶
Stop running NetScaler packet capture tool.
Synopsys¶
stop nstrace
Example¶
stop nstrace
dump nstrace¶
dump records from trace buffers to file.
Synopsys¶
dump nstrace -fileName <string>
Arguments¶
fileName
Name of the trace file.
Example¶
dump nstrace
show nstrace¶
Display nstrace parameters set through 'start nstrace' command.
Synopsys¶
show nstrace
Outputs¶
state
Current running state of trace.
scope
Scope of started trace, local or cluster level.
traceLocation
Directory where current trace files are saved.
nf
Number of files to be generated in cycle.
time
Time per file (sec).
size
Size of the captured data. Set 0 for full packet trace.
mode
Capturing mode for trace. Mode can be any of the following values or combination of these values:
RX Received packets before NIC pipelining (Filter does not work when RX capturing mode is ON)
NEW_RX Received packets after NIC pipelining
TX Transmitted packets
TXB Packets buffered for transmission
IPV6 Translated IPv6 packets
C2C Capture C2C message
NS_FR_TX TX/TXB packets are not captured in flow receiver.
SSLPLAIN Decrypted SSL packets
MPTCP MPTCP master flow
Default mode: NEW_RX TXB
traceformat
Format in which trace will be generated
perNIC
Use separate trace files for each interface. Works only with tcpdump format.
fileName
Name of the trace file.
fileId
ID for the trace file name for uniqueness. Should be used only with -name option.
filter
Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format:
<expression> [<relop> <expression>]
<relop> = ( && | || )
nstrace supports two types of filter expressions:
Classic Expressions:
[Note: Classic Expressions are not supported in non-default partitions]
<expression> = the expression string in the format:
<qualifier> <operator> <qualifier-value>
<qualifier> = SOURCEIP.
<qualifier-value> = A valid IP address
<qualifier> = SOURCEPORT.
<qualifier-value> = A valid port number.
<qualifier> = DESTIP.
<qualifier-value> = A valid IP address.
<qualifier> = DESTPORT.
<qualifier-value> = A valid port number.
<qualifier> = IP.
<qualifier-value> = A valid IP address.
<qualifier> = PORT.
<qualifier-value> = A valid port number.
<qualifier> = SVCNAME.
<qualifier-value> = The name of a service.
<qualifier> = VSVRNAME.
<qualifier-value> = The name of a vserver.
<qualifier> = CONNID
<qualifier-value> = A valid PCB dev number.
<qualifier> = VLAN
<qualifier-value> = A valid VLAN ID.
<qualifier> = INTF
<qualifier-value> = A valid interface id in the form of x/y
(n/x/y in case of cluster interface).
<operator> = ( == | eq | != | neq | > | gt
| < | lt | >= | ge | <= | le | BETWEEN )
eg: start nstrace -filter "SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80)"
The filter expression should be given in double quotes.
Default Expressions:
<expression> =:
CONNECTION.<qualifier>.<qualifier-method>.(<qualifier-value>)
<qualifier> = SRCIP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.SRCIP.EQ(127.0.0.1)
<qualifier> = DSTIP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.DSTIP.EQ(127.0.0.1)
<qualifier> = IP
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv4 address.
example = CONNECTION.IP.EQ(127.0.0.1)
<qualifier> = SRCIPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1)
<qualifier> = DSTIPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1)
<qualifier> = IPv6
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid IPv6 address.
example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1)
<qualifier> = SRCPORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.SRCPORT.EQ(80)
<qualifier> = DSTPORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.DSTPORT.EQ(80)
<qualifier> = PORT
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid port number.
example = CONNECTION.PORT.EQ(80)
<qualifier> = VLANID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid VLAN ID.
example = CONNECTION.VLANID.EQ(0)
<qualifier> = CONNID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid PCB dev number.
example = CONNECTION.CONNID.EQ(0)
<qualifier> = PPEID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid core ID.
example = CONNECTION.PPEID.EQ(0)
<qualifier> = SVCNAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = A valid text string.
example = CONNECTION.SVCNAME.EQ("name")
<qualifier> = LB_VSERVER.NAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = LB vserver name.
example = CONNECTION.LB_VSERVER.NAME.EQ("name")
<qualifier> = CS_VSERVER.NAME
<qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH
| ENDSWITH ]
<qualifier-value> = CS vserver name.
example = CONNECTION.CS_VSERVER.NAME.EQ("name")
<qualifier> = INTF
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = A valid interface id in the
form of x/y.
example = CONNECTION.INTF.EQ("x/y")
<qualifier> = SERVICE_TYPE
<qualifier-method> = [ EQ | NE ]
<qualifier-value> = ( SVC_HTTP | FTP | TCP | UDP | SSL |
SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS |
RPCCLNT | SVC_DNS | ADNS | SNMP | RTSP | DHCPRA | ANY|
MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP |
SVC_MYSQL | SVC_MSSQL | SERVICE_UNKNOWN )
example = CONNECTION.SERVICE_TYPE.EQ(ANY)
<qualifier> = TRAFFIC_DOMAIN_ID
<qualifier-method> = [ EQ | NE | GT | GE | LT | LE
| BETWEEN ]
<qualifier-value> = A valid traffic domain ID.
example = CONNECTION.TRAFFIC_DOMAIN_ID.EQ(0)
eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))"
The filter expression should be given in double quotes.
common use cases:
Trace capturing full sized traffic from/to ip 10.102.44.111, excluding loopback traffic
start nstrace -size 0 -filter "CONNECTION.IP.NE(127.0.0.1) && CONNECTION.IP.EQ(10.102.44.111)"
Trace capturing all traffic to (terminating at) port 80 or 443
start nstrace -size 0 -filter "CONNECTION.DSTPORT.EQ(443) || CONNECTION.DSTPORT.EQ(80)"
Trace capturing all backend traffic specific to service service1 along with corresponding client side traffic
start nstrace -size 0 -filter "CONNECTION.SVCNAME.EQ("service1")" -link ENABLED
Trace capturing all traffic through NS interface 1/1
start nstrace -filter "CONNECTION.INTF.EQ("1/1")"
Trace capturing all traffic specific through vlan 2
start nstrace -filter "CONNECTION.VLANID.EQ(2)"
Trace capturing all frontend (client side) traffic specific to lb vserver vserver1 along with corresponding server side traffic
start nstrace -size 0 -filter "CONNECTION.LB_VSERVER.NAME.EQ("vserver1")" -link ENABLED
link
Includes filtered connection's peer traffic.
nodes
Nodes on which tracing is started.
merge
Specify how traces across PE's are merged
doruntimecleanup
Enable or disable runtime temp file cleanup
traceBuffers
Number of 16KB trace buffers
skipRPC
skip RPC packets
inMemoryTrace
Logs packets in appliance's memory and dumps the trace file on stopping the nstrace operation
Example¶
show nstrace