This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,
I have a script in order to apply a lot of test about one trace that I give in the argument of script. Today, I have to add the feature of support traces of NetScaler and My script work in libpcap format. So I have tried to convert netscaler trace to libcap format with wireshark because I am know that wireshark support this format but, I have been able to change the format. How Could I change the format of this trace?
Thank you

asked 19 Feb '14, 03:38

Cansado2930's gravatar image

Cansado2930
16235
accept rate: 0%


AFIAK, you cannot convert a Netscaler format to pcap/pcapng directly with Wireshark/tshark/editcap, at least it did not work in my tests.

tshark -nr nstrace1_test.cap -w output.pcap
tshark: The capture file being read can't be written as a "pcapng" file.

editcap nstrace1_test.cap output.pcap
editcap: Can't open or create output.pcap: Files from that network type can't be saved in that format

However, there seems to be a Citrix tool to convert those files.

nsapimgr -s tcpdump=1 -K nstrace1.cap -k output.pcap

Please ask in the Citrix forum for details

Regards
Kurt

permanent link

answered 19 Feb '14, 05:39

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 19 Feb '14, 05:40

The citrix doc lists commands to covert nstrace files (.cap) to pcap files.

I've just used it with a current Netscaler 11.1.

(27 Apr '17, 05:02) Uli
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×37
×24
×19
×2

question asked: 19 Feb '14, 03:38

question was seen: 5,222 times

last updated: 27 Apr '17, 05:02

p​o​w​e​r​e​d by O​S​Q​A