Hello, For one of our Netscalers we are seeing 4-5 Mbps bandwidth traffic in, when there are only 1-2 or less users. We have raised a case with Citrix. They were in hurry to close the ticket saying everything is fine. We have controlup, which shows the "traffic in" is 4-5 Mbps whereas traffic out is very low. How can we know the source server which is sending this traffic?

I would ask our network team to check the FW logs. Otherwise you could use ADM on the VIP published externally. Syslog with TCP logging could also help. You can also capture the traffic in NS and via wireshark have a breakdown per IP.

I've already pulled the wireshark capture. Is there a specific counter in netscaler trace to capture only traffic in? There are tons of TCP retransmission errors in the capture.

Have a look at statistics endpoints in the capture (wireshark).

You could use the VLANID in the filter as you have a different one between the outside and inside one, no? You can also specify the INTF for the interfaces.

you can use the extended NS info to filter for only rx packets, a specific interface, and/or even an ns-vlan to cut down on the static.