HTTP-ECV monitor uses SNIP or NSIP as source?

I believe ECV uses nsip, since it is scriptable. But you can move it to a snip. https://docs.netscaler.com/en-us/citrix-adc/current-release/networking/source-citrix-adc-freebsd-traffic-from-snip.html

It uses the same than the service it is bound to, mine is using the SNIP.

nstcpdump.sh knows and tell the truth ;-)