When troubleshooting resets on a NetScaler–load-balanced intranet site, which NetScaler tool should be used to capture and analyze traffic?

• A. Take a packet trace with nstrace and analyze with WireShark.
• B. View the new nslog from the command-line interface (CLI) to look for packet resets from the NetScaler.
• C. Look in the Event Viewer for packet resets from the NetScaler.
• D. Use the nslog to look for packet resets on the NetScaler.

Answer: (A)

To diagnose resets, you need visibility into the actual packets exchanged between the client, NetScaler, and the server. Taking a packet trace with nstrace on the NetScaler and analyzing it in WireShark provides a PCAP of the real traffic, letting you see TCP flags, RSTs, sequence numbers, timing, and retransmissions. This granular, packet-level view is what reveals where a reset is coming from and why. Logs and event viewers only show text events or summaries and don’t capture the raw frames you need to diagnose transport-layer resets, so they Can’t provide the full picture. Using nstrace and WireShark is the most effective way to capture and analyze the traffic causing the resets.