Expressions for TCP, UDP, and VLAN data

Last published : Sep 22, 2026
TCP and UDP data take the form of a string or a number. For expression prefixes that return string values for TCP and UDP data, you can apply any text-based operations. For more information, see Advanced policy expressions: Evaluating text.
For expression prefixes that return numeric value, such as a source port, you can apply an arithmetic operation. For more information, see Basic operations on expression prefixes and Compound operations for numbers.
The following table describes prefixes that extract TCP and UDP data from client.
GET Operation Description
CLIENT.TCP.PAYLOAD(<integer>) Returns TCP payload data as a string, starting with the first character in the payload and continuing for the number of characters in the <integer> argument. You can apply any text-based operation to this prefix.
CLIENT.TCP.SRCPORT Returns the ID of the current packet's source port as a number.
CLIENT.TCP.DSTPORT Returns the ID of the current packet's destination port as a number.
CLIENT.TCP.OPTIONS Returns the TCP options set by the client. Examples of TCP options are Maximum Segment Size (MSS), Window Scale, Selective Acknowledgements (SACK), and Time Stamp Option. The COUNT, TYPE(<type>), and TYPE_NAME(<m>) operators can be used with this prefix. For the TCP options set by the server, see the SERVER.TCP.OPTIONS prefix.
CLIENT.TCP.OPTIONS.COUNT Returns the number of TCP options that the client has set.
CLIENT.TCP.OPTIONS.TYPE(<type>) Returns the value of the TCP option whose type (or option kind) is specified as the argument. The value is returned as a string of bytes in big endian format (or network byte order). Parameters: type - Type value
CLIENT.TCP.OPTIONS.TYPE_NAME(<m>) Returns the value of the TCP option whose enumeration constant is specified as the argument. The enumeration constants that you can pass as the argument are REPEATER, TIMESTAMP, SACK_PERMITTED, WINDOW, and MAXSEG. To specify the TCP option kind instead of these enumeration constants, use CLIENT.TCP.OPTIONS.TYPE(<type>). For other TCP options, you must use CLIENT.TCP.OPTIONS.TYPE(<type>). Parameters: m - TCP option enumeration constant
CLIENT.TCP.REPEATER_OPTION.EXISTS Returns a Boolean TRUE if Repeater TCP options exist.
CLIENT.TCP.REPEATER_OPTION.IP Returns the branch repeater's IPv4 address from the Repeater TCP options.
CLIENT.TCP.REPEATER_OPTION.MAC Returns the branch repeater's MAC address from the Repeater TCP options.
CLIENT.UDP.DNS.DOMAIN Returns the DNS domain name.
CLIENT.UDP.DNS.DOMAIN.EQ("<hostname>") Returns a Boolean TRUE if the domain name matches the <hostname> argument. The comparison is case insensitive. Following is an example: client.udp.dns.domain.eq("www.mycompany.com")
CLIENT.UDP.DNS.IS_AAAAREC Returns a Boolean TRUE if the record type is AAAA. These types of records indicate an IPv6 address in forward lookups.
CLIENT.UDP.DNS.IS_ANYREC Returns a Boolean TRUE if it is of any record type.
CLIENT.UDP.DNS.IS_AREC Returns a Boolean TRUE if the record is type A. Type A records provide the host address.
CLIENT.UDP.DNS.IS_CNAMEREC Returns a Boolean TRUE if the record is of type CNAME. In systems that use multiple names to identify a resource, there is one canonical name and a number of aliases. The CNAME provides the canonical name.
CLIENT.UDP.DNS.IS_MXREC Returns a Boolean TRUE if the record is of type MX (mail exchanger). This DNS record describes a priority and a host name. The MX records for the same domain name specify the email servers in the domain and the priority for each server.
CLIENT.UDP.DNS.IS_NSREC Returns a Boolean TRUE if the record is of type NS. This is a name server record that includes a host name with an associated A record. This enables locating the domain name that is associated with the NS record.
CLIENT.UDP.DNS.IS_PTRREC Returns a Boolean TRUE if the record is of type PTR. This is a domain name pointer and is often used to associate a domain name with an IPv4 address.
CLIENT.UDP.DNS.IS_SOAREC Returns a Boolean TRUE if the record is of type SOA. This is a start of authority record.
CLIENT.UDP.DNS.IS_SRVREC Returns a Boolean TRUE if the record is of type SRV. This is a more general version of the MX record.
CLIENT.UDP.DSTPORT Returns the numeric ID of the current packet's UDP destination port.
CLIENT.UDP.SRCPORT Returns the numeric ID of the current packet's UDP source port.
CLIENT.UDP.LENGTH Returns the numeric ID of the current packet's UDP length.
CLIENT.UDP.CHECKSUM Returns the numeric ID of the current packet's UDP checksum.
CLIENT.UDP.PAYLOAD Returns current packet's UDP payload.
CLIENT.UDP.RADIUS Returns RADIUS data for the current packet.
CLIENT.UDP.RADIUS.ATTR_TYPE(<type>) Returns the value for the attribute type specified as the argument.
CLIENT.UDP.RADIUS.USERNAME Returns the RADIUS user name.
CLIENT.TCP.MSS Returns the maximum segment size (MSS) for the current connection as a number.
CLIENT.VLAN.ID Returns the numeric ID of the VLAN through which the current packet entered the NetScaler.
The following table describes prefixes that extract TCP and UDP data from server.
GET Operation Description
SERVER.TCP.DSTPORT Returns the numeric ID of the current packet's destination port.
SERVER.TCP.SRCPORT Returns the numeric ID of the current packet's source port.
SERVER.TCP.OPTIONS Returns the TCP options set by the server. Examples of TCP options are Maximum Segment Size (MSS), Window Scale, Selective Acknowledgements (SACK), and Time Stamp Option. The COUNT, TYPE(<type>), and TYPE_NAME(<m>) operators can be used with this prefix. For the TCP options set by the client, see the CLIENT.TCP.OPTIONS prefix.
SERVER.TCP.OPTIONS.COUNT Returns the number of TCP options that the server has set.
SERVER.TCP.OPTIONS.TYPE(<type>) Returns the value of the TCP option whose type (or option kind) is specified as the argument. The value is returned as a string of bytes in big endian format (or network byte order). Parameters: type - Type value
SERVER.TCP.OPTIONS.TYPE_NAME(<m>) Returns the value of the TCP option whose enumeration constant is specified as the argument. The enumeration constants that you can pass as the argument are REPEATER, TIMESTAMP, SACK_PERMITTED, WINDOW, and MAXSEG. To specify the TCP option kind instead of these enumeration constants, use CLIENT.TCP.OPTIONS.TYPE(<type>). For other TCP options, you must use CLIENT.TCP.OPTIONS.TYPE(<type>). Parameters: m - TCP option enumeration constant
SERVER.VLAN Operates on the VLAN through which the current packet entered the NetScaler.
SERVER.UDP.DSTPORT Returns the numeric ID of the current packet's UDP destination port.
SERVER.UDP.SRCPORT Returns the numeric ID of the current packet's UDP source port.
SERVER.UDP.LENGTH Returns the numeric ID of the current packet's UDP length.
SERVER.UDP.CHECKSUM Returns the numeric ID of the current packet's UDP checksum.
SERVER.UDP.PAYLOAD Returns current packet's UDP payload.
SERVER.VLAN.ID Returns the numeric ID of the VLAN through which the current packet entered the NetScaler.