RDP/ICA filter for Citrix

[C152]

Hello,

Our NT-administrator asked me to snif the network for specific RDP and ICA-protocols. This is a requirement to better understand how our new Citrix server will behave on our network. Can anybody tell me how I can make a filter for this. I am familiar with creating filters, I just don't have any information on these two protocols. Which protocol can I specify ? What pattern(s) should I filter ?
Kind regards,

C152

 

[jrsavage]

C152,

Set up test scenario to capture data to and from the citrix server. Set a capture filter with the server IP address to "any" then start a capture and run the applications that will be communicating with the server. Stop and view the capture and find the source and destination UDP/TCP ports within the packets. Then add them to sniffer under tools > options > protocols. At this point Sniffer will recognize the added protocols. Another way would be to do the capture as described above, then set a data pattern filter based upon the source and destination ports. All of this of course is dependant on the ports being unique to these protocols.

J.R. Savage
Sniffer SE
Dallas