Network telemetry

Last published : Oct 12, 2026
Network metrics are critical for Citrix session troubleshooting because the performance and stability of a Citrix session are heavily dependent on the underlying network conditions. Unlike a local application, a Citrix session involves streaming an interactive desktop or application experience over a network, meaning any network instability or bottleneck will directly impact the user’s perception of performance.
For details about the network metrics available in Citrix Monitor and Director, see Diagnose Session Performance issues.
Related information
HDX™ connectivity

System requirements

The following are the system requirements for using Network Telemetry:
  • Control plane
    • Citrix DaaS
    • Citrix Virtual Apps and Desktops 2503 or later
  • Virtual Delivery Agent (VDA)
    • Windows: version 2503 or later
    • Linux: version 2507 or later
    • Mac: version 2507 or later
  • Workspace app
    • Windows: version 2503 or later
    • Linux: version 2508 or later
    • Mac: version 2505 or later
  • Access tier
    • Citrix® StoreFront Cloud
    • Citrix StoreFront 2402 or later
    • Citrix Gateway Service
    • Citrix NetScaler Gateway 14.1 Build 47.46 or later (14.1 Build 72.57 or later required for EDT support)

Network requirements

If you are using Citrix Gateway Service, there are no additional network requirements. However, if you are using NetScaler Gateway, there are additional requirements to use Network Telemetry, which are outlined below.

Session hosts

If your session hosts have a firewall such as Windows Defender Firewall, you must allow the following inbound traffic for connections from NetScaler Gateway.
Description Source Protocol Port
Connection from NetScaler Gateway NetScaler SNIP UDP 443
Connection from NetScaler Gateway NetScaler SNIP TCP 443
NOTE:
The VDA installer adds the appropriate inbound rules to Windows Defender Firewall. If you use a different firewall, you must add the rules above.

Internal network

The following are the firewall requirements for your internal network:
Description Protocol Source Source port Destination Destination port
Connection from NetScaler Gateway UDP NetScaler SNIP 1024-65535 VDA network 443
Connection from NetScaler Gateway TCP NetScaler SNIP 1024-65535 VDA network 443

Configuration

Network telemetry is disabled by default. You can configure this feature via Citrix policy in Studio using the following setting.
  • Network telemetry: defines whether to enable or disable the feature.

Considerations

The following are considerations for using Network Telemetry:
  • To ensure monitoring data remains secure while in transit, connections from NetScaler Gateway to the session hosts are secured with TLS/DTLS when Network Telemetry is enabled. As a result, connections are established on ports UDP 443 (HDX over EDT) and TCP 443 (HDX over TCP) by default. Refer to HDX features managed through the registry if you wish to change the port number.
  • Self-managed certificates are used to faciliate network-level encryption for session connections. See HDX Direct certificate management for details on certificate management. Please note that enabling Network Telemetry does not enable HDX Direct.
  • Network Telemetry for EDT is supported with NetScaler version 14.1 Build 72.57 and newer. If you are using an older version of NetScaler, sessions will be forced to use TCP if Network Telemetry is enabled.