What port(s) does / do the keyword "citrix" match? Where is this defined? Is it editable?
12.4 series code on 28xx routers
'show ip nbar port-map' should reveal the ports each protcol is using to classify traffic.
In global config mode 'ip nbar port-map' may be used to modify the ports being used.
The 'ip nbar custom' command can also be handy.