I posted a few weeks ago about using Wireshark to inspect packets on your network. Scott Reeves demonstrates the flow graph feature of the Wireshark tool, which can help you check connections between client server, finding timeouts, re-transmitted frames, or dropped connections. Using the flow graph feature on Wireshark Icmp: to restrict recording of the packets only to the ICMP packets. The following is a list of some commonly used tcpdump options supported with the nstcpdump.sh script: Note: Unless you have specified a packet count, discussed later in this article, you must stop the nstcpdump.sh script either by running the kill command or by pressing the Ctrl+ C keys simultaneously. The following is the syntax to run the nstcpdump.sh script:

To run the script, you must switch to the shell prompt of the ADC appliance by running the shell command from the command line interface of the appliance. Most of the entries in the output of the script have the data in the form of an IP address, TCP or UDP port number, or physical interface. NOTE: Before you run the nstcpdump.sh script you must decide the data you want in the output of the script, else a large amount of unnecessary data might be available in the output.

NOTE: nstcpdump is NOT RECOMMENDED for use on modern ADC versions, due to it's ability to interfere with Netscaler operations (especially on single-packet-engine VPX's) which can lead to traffic interruptions and even crashes in severe cases.

This article contains information about the commonly used options and filters with the nstcpdump.sh ADC script.

Wireshark filters port scheat sheet