Application Classification

SD-WAN has an integrated Deep Packet Inspection (DPI) library that enables real-time discovery and classification of applications. Using the DPI technology, the SD-WAN appliance analyses the incoming packet and classifies it as belonging to a particular application or application family.

NetScaler SD-WAN also has the ability to classify the following features of HDX traffic as ICA application with “Citrix Protocol”.

  • ICA
  • Single Stream ICA
  • Multi-Stream ICA
  • ICA over TCP
  • ICA over UDP/UDT
  • ICA over non-standard ports (Multi-ports)


Classification of ICA/HTML5 and ICA over SSL is currently not supported. HDX priority tag based QoS will continue to be supported on SD-WAN Enterprise Edition appliances.

Classification of network traffic is done during initial connections or flow establishment, therefore, pre-existing connections will not be classified as ICA. Classification of connection will also be lost when connection table is cleared manually.

Legacy FrameHawk HDX traffic, which is getting replaced with HDX Adaptive Transport Protocol, is not classified as HDX applications. It is reported as either UDP or ‘Unknown Protocol’. Similarly, audio over RTP/UDP, if configured, is not classified as ICA traffic.

Once classified, ICA application can be used in application rules and to view application statistics similar to other classified applications.

There are five default application rules for ICA applications one each for the following priority tags:

  • ICA
  • ICA Priority 0 (ICA Real-Time)
  • ICA Priority 1 (ICA Interactive)
  • ICA Priority 2 (ICA Bulk-Transfer)
  • ICA Priority 3 (ICA Background)

For more information, see Application QoS Rules.

As priority tag based HDX classification is not available in SD-WAN Standard Edition appliances the four App rules; ICA priority 0 to 3 are not in effect.

To classify HDX on non-standard ports as configured in XA/XD server policy you must add those ports in ICA port configurations. Additionally, in order to match traffic on those ports to valid IP rules, you must update ICA IP rules.

In ICA IP and port list you can specify non-standard ports used in XA/XD policy to process for HDX classification. IP address is used to further restrict the ports to specific destination. Use ‘*’ for port destined to any IP address. IP address with combination of SSL port is also used to indicate that the traffic is likely ICA even though traffic is not finally classified as ICA. This indication is used to send L4 AppFlow records to support multi-hop reports in MAS.

Classifying Encrypted Traffic

NetScaler SD-WAN detects and reports encrypted traffic, as part of application reporting, in the following two methods:

  • For HTTPS traffic, the DPI engine inspects the SSL certificate to read the common name, which carries the name of the service (for example - Facebook, Twitter). Depending on the application architecture only one certificate may be used for several service types (for example - email, news and so on). If different services utilize different certificates, the DPI engine would be able to differentiate between services.
  • For applications that utilize their own encryption protocol, the DPI engine looks for binary patterns in the flows, for instance in case of Skype the DPI engine looks for a binary pattern inside the certificate and determines the application.

To configure application classification settings:

  1. In the Configuration Editor, click Advanced> Global > Applications > Settings.

    localized image

  2. Select Enable Deep Packet Inspection. This enables application classification on the appliance. You can, view, and monitor application statistics on the SD-WAN Center. For more information, see How to View Application Statistics.


    By default, Enable Deep Packet Inspection will collect statistics for classified data.

  3. Select Enable Deep Packet Inspection for Citrix ICA Applications. This enables classification of Citrix ICA applications and collects statistics for user, sessions and flow counts. Without this option enabled, some of the flavor of HDX traffic may still be classified and QoE calculated but statistics on SD-WAN center will not be available. You can, view, and monitor ICA application statistics on the SD-WAN Center. This option is enabled by default. For more information, see How to View HDX Reports.

  4. Select Enable Multi-stream ICA to allow multiple ICA streams in a session. This option is disabled by default and should only be enabled to provide QoS per stream type.

  5. In DPI ICA Port, specify non-standard ports used in XA/XD policy to process for HDX classification. Do not include standard port numbers 2598 or 1494 in this list, as these are already included internally.

  6. In DPI ICA IP, specify the IP address to be used to further restrict the ports to specific destination.


    Use ‘*’ for port destined to any IP address.

  7. Click Apply

    You can configure application classification settings at each site individually. Click Connections, select a site and click Applications Settings. You can also choose to use the global application settings.

    localized image

Search Applications

You can search for an application to determine the application family name. A brief description of the application is also provided.

To search for an application:

  1. In the Configuration Editor, click Advanced > Global > Application > Search.

  2. Click Add and in the Search field type the name of the application.

  3. Click Revert.

    A brief description of the Application and the Application Family name appear.

    localized image


    For information on applications that the SD-WAN appliance can identify using Deep Packet Inspection, see Application Signature Library.

Application Objects

Application objects enable you to group different types of match criteria into a single object that can be used in firewall policies. IP Protocol, Application, and Application Family are the available match types.

To create an application object:

  1. In the Configuration Editor, click Advanced > Global > Applications > Application Objects.

  2. Click Add and, in the Name field, enter a name for the object.

  3. Click + in the Application Match Criteria section.

  4. Select one of the following match types:

    • IP Protocol: Specify the protocol, network IP address, port number, and, DSCP tag.
    • Application: Specify the application name, network IP address, port number, and, DSCP tag.
    • Application Family: Select an application family and specify the network IP address, port number, and, DSCP tag.
  5. Click + to add more application match criteria.

  6. Click Apply.

    localized image

Using Application Classification with a Firewall

The classification of traffic as applications and application families enables you to use the application, application families and application objects as match types to filter traffic and apply firewall policy and rules. This applies for all Pre, Post and local policies. For more information about firewall, see Stateful Firewall and NAT Support.

localized image