This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

NetScaler to Pcap

0

Hi,
I have a script in order to apply a lot of test about one trace that I give in the argument of script. Today, I have to add the feature of support traces of NetScaler and My script work in libpcap format. So I have tried to convert netscaler trace to libcap format with wireshark because I am know that wireshark support this format but, I have been able to change the format. How Could I change the format of this trace?
Thank you

asked 19 Feb '14, 03:38

Cansado2930's gravatar image

Cansado2930
16●2●3●5
accept rate: 0%

One Answer:

4

AFIAK, you cannot convert a Netscaler format to pcap/pcapng directly with Wireshark/tshark/editcap, at least it did not work in my tests.

tshark -nr nstrace1_test.cap -w output.pcap
tshark: The capture file being read can't be written as a "pcapng" file.

editcap nstrace1_test.cap output.pcap
editcap: Can't open or create output.pcap: Files from that network type can't be saved in that format

However, there seems to be a Citrix tool to convert those files.

nsapimgr -s tcpdump=1 -K nstrace1.cap -k output.pcap

Please ask in the Citrix forum for details

Regards
Kurt

answered 19 Feb ‘14, 05:39

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 19 Feb ‘14, 05:40

The citrix doc lists commands to covert nstrace files (.cap) to pcap files.

I’ve just used it with a current Netscaler 11.1.

(27 Apr ‘17, 05:02) Uli