nstrace¶

The following operations can be performed on "nstrace":

start nstrace¶

Start NetScaler packet capture tool.

Synopsys¶

start nstrace [-nf <positive_integer>] [-time <positive_integer> | -filesize <positive_integer>] [-size <positive_integer>] [-mode <mode> ...] [-perNIC ( ENABLED | DISABLED )] [-fileName <string>] [-fileId <string>] [-filter <expression>] [-link ( ENABLED | DISABLED )] [-nodes <positive_integer> ...] [-traceformat ( NSCAP | PCAP )] [-merge <merge>] [-doruntimecleanup ( ENABLED | DISABLED )] [-traceBuffers <positive_integer>] [-skipRPC ( ENABLED | DISABLED )] [-inMemoryTrace ( ENABLED | DISABLED )]

Arguments¶

nf

Number of files to be generated in cycle.

Default value: 24

Minimum value: 1

Maximum value: 100

time

Time per file (sec).

Default value: 3600

Minimum value: 1

size

Size of the captured data. Set 0 for full packet trace.

Default value: 164

Minimum value: 0

Maximum value: 1514

mode

Capturing mode for trace. Mode can be any of the following values or combination of these values:

  RX          Received packets before NIC pipelining (Filter does not work when RX capturing mode is ON)

  NEW_RX      Received packets after NIC pipelining

  TX          Transmitted packets

  TXB         Packets buffered for transmission

  IPV6        Translated IPv6 packets

  C2C         Capture C2C message

  NS_FR_TX    TX/TXB packets are not captured in flow receiver.

  SSLPLAIN    Decrypted SSL packets

  MPTCP       MPTCP master flow

  Default mode: NEW_RX TXB

Default value: DEFAULT_MODE

perNIC

Use separate trace files for each interface. Works only with tcpdump format.

Possible values: ENABLED, DISABLED

Default value: DISABLED

fileName

Name of the trace file.

fileId

ID for the trace file name for uniqueness. Should be used only with -name option.

filter

Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format:

 <expression> [<relop> <expression>]

 <relop> = ( && | || )

 nstrace supports two types of filter expressions:

 Classic Expressions:

 [Note: Classic Expressions are not supported in non-default partitions]

 <expression> = the expression string in the format:

 <qualifier> <operator> <qualifier-value>

 <qualifier> = SOURCEIP.

 <qualifier-value> = A valid IP address

 <qualifier> = SOURCEPORT.

 <qualifier-value> = A valid port number.

 <qualifier> = DESTIP.

 <qualifier-value> = A valid IP address.

 <qualifier> = DESTPORT.

 <qualifier-value> = A valid port number.

 <qualifier> = IP.

 <qualifier-value> = A valid IP address.

 <qualifier> = PORT.

 <qualifier-value> = A valid port number.

 <qualifier> = SVCNAME.

 <qualifier-value> = The name of a service.

 <qualifier> = VSVRNAME.

 <qualifier-value> = The name of a vserver.

 <qualifier> = CONNID

 <qualifier-value> = A valid PCB dev number.

 <qualifier> = VLAN

 <qualifier-value> = A valid VLAN ID.

 <qualifier> = INTF

 <qualifier-value> = A valid interface id in the form of x/y

             (n/x/y in case of cluster interface).

 <operator> = ( == | eq | != | neq | > | gt

 | < | lt | >= | ge | <= | le | BETWEEN )

 eg: start nstrace -filter "SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80)"

 The filter expression should be given in double quotes.

 Default Expressions:

 <expression> =:

 CONNECTION.<qualifier>.<qualifier-method>.(<qualifier-value>)

 <qualifier> = SRCIP

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv4 address.

 example = CONNECTION.SRCIP.EQ(127.0.0.1)

 <qualifier> = DSTIP

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv4 address.

 example = CONNECTION.DSTIP.EQ(127.0.0.1)

 <qualifier> = IP

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv4 address.

 example = CONNECTION.IP.EQ(127.0.0.1)

 <qualifier> = SRCIPv6

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv6 address.

 example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1)

 <qualifier> = DSTIPv6

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv6 address.

 example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1)

 <qualifier> = IPv6

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv6 address.

 example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1)

 <qualifier> = SRCPORT

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid port number.

 example = CONNECTION.SRCPORT.EQ(80)

 <qualifier> = DSTPORT

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid port number.

 example = CONNECTION.DSTPORT.EQ(80)

 <qualifier> = PORT

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid port number.

 example = CONNECTION.PORT.EQ(80)

 <qualifier> = VLANID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid VLAN ID.

 example = CONNECTION.VLANID.EQ(0)

 <qualifier> = CONNID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid PCB dev number.

 example = CONNECTION.CONNID.EQ(0)

 <qualifier> = PPEID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid core ID.

   example = CONNECTION.PPEID.EQ(0)

 <qualifier> = SVCNAME

 <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH

                     | ENDSWITH ]

 <qualifier-value>  = A valid text string.

 example = CONNECTION.SVCNAME.EQ("name")

 <qualifier> = LB_VSERVER.NAME

 <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH

                    | ENDSWITH ]

 <qualifier-value>  = LB vserver name.

 example = CONNECTION.LB_VSERVER.NAME.EQ("name")

 <qualifier> = CS_VSERVER.NAME

 <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH

                    | ENDSWITH ]

 <qualifier-value>  = CS vserver name.

 example = CONNECTION.CS_VSERVER.NAME.EQ("name")

 <qualifier> = INTF

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  =  A valid interface id in the

                form of x/y.

 example = CONNECTION.INTF.EQ("x/y")

 <qualifier> = SERVICE_TYPE

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = ( SVC_HTTP | FTP | TCP | UDP | SSL |

    SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS |

    RPCCLNT | SVC_DNS | ADNS | SNMP | RTSP | DHCPRA | ANY|

    MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP |

    SVC_MYSQL | SVC_MSSQL | SERVICE_UNKNOWN )

 example = CONNECTION.SERVICE_TYPE.EQ(ANY)

 <qualifier> = TRAFFIC_DOMAIN_ID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid traffic domain ID.

 example = CONNECTION.TRAFFIC_DOMAIN_ID.EQ(0)

 eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))"

 The filter expression should be given in double quotes.

common use cases:

Trace capturing full sized traffic from/to ip 10.102.44.111, excluding loopback traffic

start nstrace -size 0 -filter "CONNECTION.IP.NE(127.0.0.1) && CONNECTION.IP.EQ(10.102.44.111)"

Trace capturing all traffic to (terminating at) port 80 or 443

start nstrace -size 0 -filter "CONNECTION.DSTPORT.EQ(443) || CONNECTION.DSTPORT.EQ(80)"

Trace capturing all backend traffic specific to service service1 along with corresponding client side traffic

start nstrace -size 0 -filter "CONNECTION.SVCNAME.EQ("service1")" -link ENABLED

Trace capturing all traffic through NS interface 1/1

start nstrace -filter "CONNECTION.INTF.EQ("1/1")"

Trace capturing all traffic specific through vlan 2

start nstrace -filter "CONNECTION.VLANID.EQ(2)"

Trace capturing all frontend (client side) traffic specific to lb vserver vserver1 along with corresponding server side traffic

start nstrace -size 0 -filter "CONNECTION.LB_VSERVER.NAME.EQ("vserver1")" -link ENABLED

link

Includes filtered connection's peer traffic.

Possible values: ENABLED, DISABLED

Default value: DISABLED

nodes

Nodes on which tracing is started.

Minimum value: 0

Maximum value: 32

filesize

File size, in MB, treshold for rollover.

Default value: 0

Minimum value: 0

Maximum value: 65536

traceformat

Format in which trace will be generated

Possible values: NSCAP, PCAP

Default value: 0

merge

Specify how traces across PE's are merged

Possible values: ONSTOP, ONTHEFLY, NOMERGE

Default value: 0

doruntimecleanup

Enable or disable runtime temp file cleanup

Possible values: ENABLED, DISABLED

Default value: ENABLED

traceBuffers

Number of 16KB trace buffers

Default value: 5000

Minimum value: 1000

skipRPC

skip RPC packets

Possible values: ENABLED, DISABLED

Default value: DISABLED

inMemoryTrace

Logs packets in appliance's memory and dumps the trace file on stopping the nstrace operation

Possible values: ENABLED, DISABLED

Default value: DISABLED

Example¶

start nstrace -time 10

stop nstrace¶

Stop running NetScaler packet capture tool.

Synopsys¶

stop nstrace

Example¶

stop nstrace

dump nstrace¶

dump records from trace buffers to file.

Synopsys¶

dump nstrace -fileName <string>

Arguments¶

fileName

Name of the trace file.

Example¶

dump nstrace

show nstrace¶

Display nstrace parameters set through 'start nstrace' command.

Synopsys¶

show nstrace

Outputs¶

state

Current running state of trace.

scope

Scope of started trace, local or cluster level.

traceLocation

Directory where current trace files are saved.

nf

Number of files to be generated in cycle.

time

Time per file (sec).

size

Size of the captured data. Set 0 for full packet trace.

mode

Capturing mode for trace. Mode can be any of the following values or combination of these values:

  RX          Received packets before NIC pipelining (Filter does not work when RX capturing mode is ON)

  NEW_RX      Received packets after NIC pipelining

  TX          Transmitted packets

  TXB         Packets buffered for transmission

  IPV6        Translated IPv6 packets

  C2C         Capture C2C message

  NS_FR_TX    TX/TXB packets are not captured in flow receiver.

  SSLPLAIN    Decrypted SSL packets

  MPTCP       MPTCP master flow

  Default mode: NEW_RX TXB

traceformat

Format in which trace will be generated

perNIC

Use separate trace files for each interface. Works only with tcpdump format.

fileName

Name of the trace file.

fileId

ID for the trace file name for uniqueness. Should be used only with -name option.

filter

Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format:

 <expression> [<relop> <expression>]

 <relop> = ( && | || )

 nstrace supports two types of filter expressions:

 Classic Expressions:

 [Note: Classic Expressions are not supported in non-default partitions]

 <expression> = the expression string in the format:

 <qualifier> <operator> <qualifier-value>

 <qualifier> = SOURCEIP.

 <qualifier-value> = A valid IP address

 <qualifier> = SOURCEPORT.

 <qualifier-value> = A valid port number.

 <qualifier> = DESTIP.

 <qualifier-value> = A valid IP address.

 <qualifier> = DESTPORT.

 <qualifier-value> = A valid port number.

 <qualifier> = IP.

 <qualifier-value> = A valid IP address.

 <qualifier> = PORT.

 <qualifier-value> = A valid port number.

 <qualifier> = SVCNAME.

 <qualifier-value> = The name of a service.

 <qualifier> = VSVRNAME.

 <qualifier-value> = The name of a vserver.

 <qualifier> = CONNID

 <qualifier-value> = A valid PCB dev number.

 <qualifier> = VLAN

 <qualifier-value> = A valid VLAN ID.

 <qualifier> = INTF

 <qualifier-value> = A valid interface id in the form of x/y

             (n/x/y in case of cluster interface).

 <operator> = ( == | eq | != | neq | > | gt

 | < | lt | >= | ge | <= | le | BETWEEN )

 eg: start nstrace -filter "SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80)"

 The filter expression should be given in double quotes.

 Default Expressions:

 <expression> =:

 CONNECTION.<qualifier>.<qualifier-method>.(<qualifier-value>)

 <qualifier> = SRCIP

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv4 address.

 example = CONNECTION.SRCIP.EQ(127.0.0.1)

 <qualifier> = DSTIP

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv4 address.

 example = CONNECTION.DSTIP.EQ(127.0.0.1)

 <qualifier> = IP

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv4 address.

 example = CONNECTION.IP.EQ(127.0.0.1)

 <qualifier> = SRCIPv6

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv6 address.

 example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1)

 <qualifier> = DSTIPv6

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv6 address.

 example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1)

 <qualifier> = IPv6

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = A valid IPv6 address.

 example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1)

 <qualifier> = SRCPORT

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid port number.

 example = CONNECTION.SRCPORT.EQ(80)

 <qualifier> = DSTPORT

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid port number.

 example = CONNECTION.DSTPORT.EQ(80)

 <qualifier> = PORT

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid port number.

 example = CONNECTION.PORT.EQ(80)

 <qualifier> = VLANID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid VLAN ID.

 example = CONNECTION.VLANID.EQ(0)

 <qualifier> = CONNID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid PCB dev number.

 example = CONNECTION.CONNID.EQ(0)

 <qualifier> = PPEID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid core ID.

   example = CONNECTION.PPEID.EQ(0)

 <qualifier> = SVCNAME

 <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH

                     | ENDSWITH ]

 <qualifier-value>  = A valid text string.

 example = CONNECTION.SVCNAME.EQ("name")

 <qualifier> = LB_VSERVER.NAME

 <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH

                    | ENDSWITH ]

 <qualifier-value>  = LB vserver name.

 example = CONNECTION.LB_VSERVER.NAME.EQ("name")

 <qualifier> = CS_VSERVER.NAME

 <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH

                    | ENDSWITH ]

 <qualifier-value>  = CS vserver name.

 example = CONNECTION.CS_VSERVER.NAME.EQ("name")

 <qualifier> = INTF

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  =  A valid interface id in the

                form of x/y.

 example = CONNECTION.INTF.EQ("x/y")

 <qualifier> = SERVICE_TYPE

 <qualifier-method> = [ EQ | NE ]

 <qualifier-value>  = ( SVC_HTTP | FTP | TCP | UDP | SSL |

    SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS |

    RPCCLNT | SVC_DNS | ADNS | SNMP | RTSP | DHCPRA | ANY|

    MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP |

    SVC_MYSQL | SVC_MSSQL | SERVICE_UNKNOWN )

 example = CONNECTION.SERVICE_TYPE.EQ(ANY)

 <qualifier> = TRAFFIC_DOMAIN_ID

 <qualifier-method> = [ EQ | NE | GT | GE | LT | LE

                     | BETWEEN ]

 <qualifier-value>  = A valid traffic domain ID.

 example = CONNECTION.TRAFFIC_DOMAIN_ID.EQ(0)

 eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))"

 The filter expression should be given in double quotes.

common use cases:

Trace capturing full sized traffic from/to ip 10.102.44.111, excluding loopback traffic

start nstrace -size 0 -filter "CONNECTION.IP.NE(127.0.0.1) && CONNECTION.IP.EQ(10.102.44.111)"

Trace capturing all traffic to (terminating at) port 80 or 443

start nstrace -size 0 -filter "CONNECTION.DSTPORT.EQ(443) || CONNECTION.DSTPORT.EQ(80)"

Trace capturing all backend traffic specific to service service1 along with corresponding client side traffic

start nstrace -size 0 -filter "CONNECTION.SVCNAME.EQ("service1")" -link ENABLED

Trace capturing all traffic through NS interface 1/1

start nstrace -filter "CONNECTION.INTF.EQ("1/1")"

Trace capturing all traffic specific through vlan 2

start nstrace -filter "CONNECTION.VLANID.EQ(2)"

Trace capturing all frontend (client side) traffic specific to lb vserver vserver1 along with corresponding server side traffic

start nstrace -size 0 -filter "CONNECTION.LB_VSERVER.NAME.EQ("vserver1")" -link ENABLED

link

Includes filtered connection's peer traffic.

nodes

Nodes on which tracing is started.

merge

Specify how traces across PE's are merged

doruntimecleanup

Enable or disable runtime temp file cleanup

traceBuffers

Number of 16KB trace buffers

skipRPC

skip RPC packets

inMemoryTrace

Logs packets in appliance's memory and dumps the trace file on stopping the nstrace operation

Example¶

show nstrace