Client IP address in TCP option

Last published : Sep 22, 2026
The NetScaler appliance uses many ways to send the client information to the back-end server. One such method is by sending the client IP address in the TCP option. The appliance uses the TCP option number in the TCP profile, if the back-end server is using the TCP option to read the client IP address.
The NetScaler appliance sends the client IP address, in the TCP option header, only in the following packets:
  • final ACK packet of the three-way handshake
  • first data packet.
Following are some of the usage scenarios for the TCP option configuration in a NetScaler appliance.
  • Learning original client IP address
  • Selecting a language for a website
  • Block listing the selected IP addresses
Following are the two modes of operation for sending the client IP address in the TCP option:
  • Insert. In insert mode, the appliance adds the client details in the TCP option 28 (configurable but the preferable value is 28) field and sends it to the back-end server.
  • Forward. In forward mode, the virtual server receives the client IP details in the TCP option from a proxy device. For the virtual server, you must configure the same TCP option, which the proxy device has used to send the client IP details.
    The appliance then sends the client details in the TCP option field to the back-end server. For the service representing the back-end server, you can set any TCP option but the preferable value is 28.
The NetScaler appliance also supports sending the client port in the TCP option for insert mode configuration.
Notes:
  • Multiplexing is not supported for the received traffic on a virtual server if the Client IP TCP option is enabled on the bound TCP profile.
  • For a TCP or HTTP virtual server, the TCP option number is forwarded with or without this feature enabled in transparent mode.
Related information

Limitations

The TCP option configuration feature is not supported in TFO, MultiPath TCP, and HTTP2 features.

How TCP option configuration in a NetScaler appliance

The following flow diagrams show how you can configure the TCP option in the NetScaler appliances for Insert and forward operations.
Insert operation:
Insert operation
The component interact is as follows:
  • A client sends a request to NetScaler.
  • In the Insert operation, the NetScaler appliance inserts the client IP address and port in the configured TCP option of the following packets to the back-end server.
    • final ACK packet of the three-way handshake
    • first data packet
    Note:
    If the incoming traffic is HTTPS, the client IP address and the client port in the TCP option is sent in the SSL client hello message, which is the first data packet at the TCP level.
Forward operation:
Forward operation
The component interact is as follows:
  • A client sends a HTTP/HTTPS request to the NetScaler appliance.
  • For the Forward operation, the TCP option is enabled on a load balancing virtual server or a content switching virtual server and also enabled on the service. The appliance receives the client details in the TCP option number specified in the virtual server.
  • The NetScaler appliance then inserts the client IP address and port in the configured TCP option (for the service) of the following packets to the back-end server.
    • final ACK packet of the three-way handshake
    • first data packet

Configure TCP option for Insert operation

Configuring the TCP option for Insert operation consists of the following steps:
  1. Configure a TCP profile. Enable the Client IP TCP option (clientIpTcpOption), and specify the TCP option number (clientIpTcpOptionNumber). Optionally, enable the sendClientPortInTcpOption to send the client port in the TCP option header.
    Note:
    Citrix® recommends configuring TCP option number as 28 in the TCP profile.
  2. Bind the TCP profile to a service
To configure a TCP profile by using CLI:
At the command prompt, type:
  • add tcpprofile <name> -clientIpTcpOption (ENABLED | DISABLED) -clientIpTcpOptionNumber <positive_integer> -sendClientPortInTcpOption (ENABLED | DISABLED)
  • show tcpprofile <name>
To bind the TCP profile to the service by using CLI:
At the command prompt, type:
  • set service <name> –tcpprofileName <name>
  • show service <name>

Sample configuration

add tcpprofile TCP-PROFILE-1 -clientIpTcpOption ENABLED -clientIpTcpOptionNumber 28 -sendClientPortInTcpOption ENABLED
set service SERVICE-1 –tcpprofileName TCP-PROFILE-1

Configure the TCP option for Forward operation

Configuring the TCP option for forward operation consists of the following steps:
  1. Configure a TCP profile. Enable the Client IP TCP option (clientIpTcpOption), and specify the TCP option number (clientIpTcpOptionNumber).
  2. Bind the TCP profile to a load balancing or content switching virtual server
  3. Bind the TCP profile to the services.
To configure a TCP profile by using CLI:
At the command prompt, type:
  • add tcpprofile <name> -clientIpTcpOption (ENABLED | DISABLED) -clientIpTcpOptionNumber <positive_integer>
  • show tcpprofile <name>
To Bind the TCP profile to a load balancing or content switching virtual server by using CLI:
At the command prompt, type:
  • set lb vserver <name> -tcpprofileName <name>
  • show lb vserver <name>
To bind TCP profile to service by using CLI:
At the command prompt, type:
  • set service <name> -tcpprofileName p1
  • show service <name>

Sample configuration

add tcpprofile TCP-PROFILE-2 -clientIpTcpOption ENABLED -clientIpTcpOptionNumber 29
set lb vserver LBVS-2 –tcpprofileName TCP-PROFILE-2
set service SERVICE-2 -tcpprofileName TCP-PROFILE-2

Configure TCP option by using NetScaler GUI

  1. Navigate to System > Profiles.
  2. In the TCP Profile tab page, click Add.
  3. In the Configure TCP profile page, configure the following parameters:
    • clientIptcpoption. Enables the TCP option to send or receive client IP address.
    • clientiptcpoptionnumber. Sets TCP option number.
    • sendClientPortInTcpOption Sends client port in the TCP option for insert mode configuration.
  4. Click OK and Close.