This message was deleted.

Found something from nsslvpn.log that could be captured from the plugin... need to trshoot inbound UDP connections (don't ask :))

Wireshark is only supported and usable when CSA is installed (and used) with WFP driver instead of the old default DNE.

So the DNE is enabled by default and the following instructions need to be followed if using WFP https://docs.netscaler.com/en-us/citrix-gateway/13-1/vpn-user-config/select-gateway-plugin-for-users.html#windows-citrix-secu[…]s-filtering-platform

Exactly