ADC

Integrate ExtraHop Discover Appliance with NetScaler for passive traffic inspection

February 26, 2026

Contributed by:

NetScaler supports integration with the ExtraHop Discover Appliance, which is a network security and IT performance monitoring device. This device passively inspects encrypted traffic from both the frontend and backend connections. To decrypt and analyze this traffic, the ExtraHop Discover Appliance uses the SSL session secrets provided by NetScaler. The traffic is mirrored to the ExtraHop Discover Appliance through a Network Tap device or through port mirroring.

Key benefits:

Enhanced security posture: The ExtraHop Discover Appliance acts as a formidable line of defense by offering comprehensive Network Detection and Response (NDR).
Accelerated operational intelligence: Beyond security, the ExtraHop Discover Appliance provides invaluable insights for IT operations through its Network Performance Monitoring (NPM) capabilities. It offers a single source of truth for understanding the application and network performance issues.
Tangible return on investment: The operational efficiencies gained from both improved security and performance translate directly into significant cost savings and a strong return on investment (ROI).

How NetScaler is integrated with ExtraHop Discover Appliance

The following diagram shows how a NetScaler is integrated with ExtraHop Discover Appliance.

ExtraHop Discover Appliance

Configure NetScaler to integrate with the ExtraHop Discover Appliance

The integration uses a WebAssembly (WASM) module to enable secure sharing of SSL secrets with the ExtraHop Discover Appliance. Configuration involves importing necessary files, creating the WASM module, and associating it with the relevant virtual servers.

Step 1. Add a WASM module entity.

To add a WASM module entity, you need three files:

WASM file: Contains the custom logic, for example, sending SSL secret key data.
Signature file: Validates the integrity and authenticity of the WASM file for security purposes. This is necessary since the WASM file is packaged with the build.
Settings file (JSON): Provides user-specific input to the WASM module, allowing the same WASM file to be used across different virtual servers. For example, you can specify in this file the virtual server name to which the SSL secret must be sent. The keys in the JSON settings file are defined according to the requirements of the WASM module logic. To import the settings file using local, it must be present in the /var/tmp/ directory.

Sample settings file content:
```
 {
 "extrahop_vs_name": "my_vs_name",
 "send_ssl_key_as_generated": true
 }
 
```

Step 2. Import and update the WASM module on the NetScaler file system.

To import a WASM file, use the following command:

import wasm file <src> <fileName> [-overwrite] -type [signature/module/setting]
<!--NeedCopy-->

To display imported WASM files, use the following command:

show wasm file
<!--NeedCopy-->

To update the settings file, use the following command:

update wasm file <filename>
<!--NeedCopy-->

Note:

The update command is limited to modifying the JSON settings file and does not support updating the WASM logic file. The WASM code does not maintain any state, and ASYNC blocking is not supported.

Step 3. Add a WASM module.

To add a WASM module, use the following command:

add wasm module <name> -moduleFile <string> -signatureFile <string> [-settingFile <file name>]
<!--NeedCopy-->

A new parameter -settingFile <file name> is added to the add wasm module command to provide the JSON file that contains module-related settings.

Sample settings file format:

{ “extrahop_vs_name”: “my_vs_name”, “send_ssl_key_as_generated”: true }

Step 4. Bind the WASM module to a user virtual server.

After the WASM module is created, bind it to a user virtual server. This virtual server invokes the WASM code when data is received and forwards the validated data to the ExtraHop service.

Note:

You must bind an SSL certificate to the SSL virtual server. For information on creating certificates, see Create a certificate. For information on binding certificates to virtual servers, see Bind a certificate to a virtual server.

You can attach the WASM module to various types of virtual servers using the -wasmModule parameter during virtual server creation. The following types of virtual servers are supported:

Load balancing (lb)

Content switching (cs)

Cache redirection (cr)

VPN

Authentication

Command syntax: add lb/cs/cr/vpn/authentication vserver <name> <ip> <protocol> <port> [-wasmModule <wasm module name>]

Sample configurations

Configuration for sending SSL secret keys securely to the ExtraHop Discover Appliance:

import wasm file local:wasm/ns_extrahop_send_secret.wasm ssl_key_sending_wasm_file -fileType module
import wasm file local:wasm/ns_extrahop_send_secret.sig ssl_key_sending_sig_file -fileType signature
import wasm file local:ssl_key_sending_setting_file ssl_key_sending_setting_file -fileType setting
add wasm module wasm_send_mod -moduleFile ssl_key_sending_wasm_file -signatureFile ssl_key_sending_sig_file -settingFile ssl_key_sending_setting_file
add lb vserver client_facing_vs SSL -wasmModule wasm_send_mod
add service client_backend_svc <ip> SSL 443
bind lb vserver client_facing_vs client_backend_svc
<!--NeedCopy-->

Configuration for ExtraHop sideband virtual server:

import wasm file local:wasm/ns_extrahop_handle_secret.wasm ssl_key_handling_wasm_file -fileType module
import wasm file local:wasm/ns_extrahop_handle_secret.wasm -fileType signature
add wasm module wasm_handle_mod -moduleFile ssl_key_handling_wasm_file -signatureFile ssl_key_handling_sig_file
add user protocol ssl_key_handling_porto -transport SSL -wasmModule wasm_handle_mod
add service extrahop_svc 1.1.1.1 USER_SSL_TCP 443
add lb vserver extrahop_dummy_vs USER_TCP
bind lb vserver extrahop_dummy_vs extrahop_svc
add user vserver extrahop_vs ssl_key_handling_porto <ip> <port> -defaultLB extrahop_dummy_vs
<!--NeedCopy-->

Configuration for SSL certificate:

add ssl certkey client_facing_vs_ck –cert <cert name> -key <key>
add ssl certkey client_backend_svc_ck –cert <cert name> -key <key> 
add ssl certkey extrahop_verver_ck –cert <cert name> -key <key> 
add ssl certKey extrahop_svc_ck –cert <cert name> -key <key> 
bind ssl vserver client_facing_vs –certkeyName client_facing_vs_ck 
bind ssl service client_backend_svc –certkeyName client_backend_svc_ck 
bind ssl vserver extrahop_vs –certkeyName extrahop_verver_ck 
bind ssl service extrahop_svc –certkeyName extrahop_svc_ck 
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

Integrate ExtraHop Discover Appliance with NetScaler for passive traffic inspection

February 26, 2026

Contributed by:

February 26, 2026

Contributed by:

Integrate ExtraHop Discover Appliance with NetScaler for passive traffic inspection

How NetScaler is integrated with ExtraHop Discover Appliance

Configure NetScaler to integrate with the ExtraHop Discover Appliance

Sample configurations

In this article