Content inspection

Last published : Sep 24, 2026
In recent times, there is an expansion of device types to display various multimedia contents. The device types can be of mobile handsets to tablets, and to desktops. Intermediate infrastructure providers need to transform the original content from a web server to a format suitable for the device that asks for the content. The external devices inspect the content that transcodes and send it back to the client. A commonly used protocol to achieve this is ICAP. ICAP enables the NetScaler appliance to be put in various deployments. ICAP uses the content inspection technique that inspects data for malware and security issues.
Note
From 14.1-56.x, HTTP/2 is supported in ICAP mode. In versions earlier than 14.1-56.x, applications using HTTP/2 might not function properly if the traffic is sent through content inspection.

NetScaler SSL Orchestrator

NetScaler SSL Orchestrator supports SSL visibility, allowing inbound and outbound web data, including HTTP/s traffic, to be decrypted. This capability enables the implementation of policy-based service chaining, which facilitates the sequential routing of data through multiple types of inspection. Also, NetScaler SSL Orchestrator currently supports the following functionalities:
  • Inline inspection is supported in Layer 2 (L2) mode, while mirror or tap inspection is available in both L2 and Layer 3 (L3) modes, along with ICAP integration. Inline inspection functionality enables the system to analyze data in real-time as it flows through, redirecting network traffic to inspection devices for a more thorough analysis. This ensures comprehensive security coverage.
  • An Intrusion Prevention System (IPS) is a proactive security measure that examines data to identify and prevent malware and security threats from affecting the system.
  • Intrusion Detection System (IDS) is a passive method that monitors and detects malware or malicious data within the system.