Question:
Intermittently packet drop in TCP Vserver due to small window protection.

Answer:
Action plan: We can disable the small window option through nsapimgr command: root@ns# nsapimgr_wr.sh -ys small_window_protection=0 Number of PEs running: 1 Changing Connection startup small window protection from 1 to 0 ... Done. Note: nsapimgr are developers specific and these commands needs to be run only under the advice of Citrix Support. Kindly contact Citrix Support before applying any nsapimgr commands. For further information please refer KB: https://support.citrix.com/article/CTX214610

1- How long will the ip/seq no remain in the hash table?
 
We are storing Initial Receive Sequence (IRS) into hash table. Right now it is not flushed. As long as the entry is rewritten the IRS will be present in hash table.
We have the enhancement  - Small Window Protection code revamp opened to address this issue. 
 
But this is not the deciding factor for small window check. Entry in hash table decides whether to probe the client or not. (This is not applicable for HTTP/SSL/SSL TCP service types which do not have probe logic)
 
- How many entries can be stored on hash table?
 
We can have 16K entries. 
 
- What if the hash table got full?
 
As said there is no flush logic. It can be rewritten.