Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler can use this to determine which Virtual Server, host, and route this must take.

The ability to echo proprietary information to a host has interesting applications.

  • How does the Citrix Netscaler achieve this (where does it stuff the bits), and what other locations in the packet can the Netscaler (or similar device) theoretically stuff data?

  • What devices will (or will not) allow this custom data to pass through untouched?

share|improve this question
The NetScaler does what exactly? To my best knowledge, it is mostly a (reverse) proxy server with support for Citrix remoting protocols. – the-wabbit Mar 22 '13 at 23:02
Wireshark has the ability to decode this information. In there is the Virtual Server ID, among other things. This is most useful when using "source routing" and setting the web server's default GW to the SNIP of the NS. – LamonteCristo Mar 22 '13 at 23:06
could you paste a sample packet to and link it here? I still can't spot what you are asking for. – the-wabbit Mar 22 '13 at 23:12
Yahoo L3DSR also works similarly, they encode extra information in DSCP field of IP header which their kernel module decodes. – abbe Mar 24 '13 at 14:11
What is the host you talk about? If it is the realserver behind the Netscaler why would it need to echo information back? The answer will be sent back to the original sender by the Netscaler. Please elaborate more on the setup. Please paste a pcap with the packets if possible. – Sebastian Apr 5 '13 at 20:44

Most likely they are using the ToS header (DSCP). It will allow for six bits of information to be stored in the header and most often devices wont take any action based on what's stored there [especially end-users].

All devices allow ToS through as it is part of the standard IPv4 header.

share|improve this answer
According to this documentation this is exactly what they do: – Raffael Luthiger Apr 29 '13 at 8:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.