PVS Wireshark traces can get very large and could use up a lot of resources.  Here is a method that can be used to reduce the size of the traces and the impact on the PVS server.  
With the smaller trace file and lower impact, the trace can run longer and the resulting files are easier to handle. 
 

---

Instructions

These instructions are just for limiting the size and impact of collecting wireshark traces on a PVS server.  This would normally be part of a larger set of instructions that would include simultaneous tracing on the target device.   

1. Install Wireshark on the PVS server. 
2. Prepare a location to save the Wireshark traces. 
3. Configure Wireshark Output option:
   • Choose Option->Output.
   • Choose a location for the trace files. 
   • This keeps the trace file from using up the memory and paging file of the streaming server.
   • Check 'Create a new file automatically after...'
   • Configure 1 gigabytes
   • This makes the resulting files easier to handle.
   • 
4. Configure Wireshark Input option:
   • Choose the Input tab.  For a PVS streaming trace, trace only the traffic for a target device by using a capture filter:
     • Example:  Target device IP address is 10.91.8.204   
     • Capture filter:  host 10.91.8.204
     • Example two target devices:
     • Capture filter:  host 10.91.8.204 && host 10.91.5.101
   • Further reduce the size and impact of the trace by truncating the amount of each packet that is captured: 
     • Double-click the word 'default' in the Snaplen column.
     • The default is 65535.  Edit the value to read:  384

Now Wireshark is ready to begin tracing the PVS-side of the streaming traffic. 
If the target device is powered off, you can click "Start" and there will be nothing collected until the target device is powered up. 
 

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Capturing network traces on a PVS server might create very large files that are hard to handle. Here is a way to reduce the size of the capture.

https://support.citrix.com/article/CTX139171