NetScaler to Pcap

Hi,
I have a script in order to apply a lot of test about one trace that I give in the argument of script. Today, I have to add the feature of support traces of NetScaler and My script work in libpcap format. So I have tried to convert netscaler trace to libcap format with wireshark because I am know that wireshark support this format but, I have been able to change the format. How Could I change the format of this trace?
Thank you

asked 19 Feb '14, 03:38

Cansado2930
16●2●3●5
accept rate: 0%

One Answer:

active answers oldest answers newest answers popular answers

AFIAK, you cannot convert a Netscaler format to pcap/pcapng directly with Wireshark/tshark/editcap, at least it did not work in my tests.

tshark -nr nstrace1_test.cap -w output.pcap
tshark: The capture file being read can't be written as a "pcapng" file.

editcap nstrace1_test.cap output.pcap
editcap: Can't open or create output.pcap: Files from that network type can't be saved in that format

However, there seems to be a Citrix tool to convert those files.

nsapimgr -s tcpdump=1 -K nstrace1.cap -k output.pcap

Please ask in the Citrix forum for details

Regards
Kurt

permanent link

answered 19 Feb '14, 05:39

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 19 Feb '14, 05:40

The citrix doc lists commands to covert nstrace files (.cap) to pcap files.

I've just used it with a current Netscaler 11.1.

(27 Apr '17, 05:02) Uli

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

libpcap ×37
format ×24
convert ×19
netscaler ×2

question asked: 19 Feb '14, 03:38

question was seen: 5,503 times

last updated: 27 Apr '17, 05:02

NetScaler to Pcap

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions