For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

goldberg_33306's avatar
goldberg_33306
Icon for Nimbostratus rankNimbostratus
Oct 10, 2012

Basic TCPDUMP Question

When I capture traffic on the "internal" and "external" interfaces, why do I see the same syn from the client on both interfaces? I know this is a basic feature within F5 LTM, but just looking for a...
config
design
goldberg_33306's avatar
goldberg_33306
Icon for Nimbostratus rankNimbostratus
Oct 10, 2012
Thanks for the link. It does explain a few things but for a standard virtual server, I don't see the syn (from the client) being re-used on the server end. Here is an example:

 

 

tcpdump -i external -n host 101.20.17.25 and port 80

 

12:03:59.218520 101.20.17.25.1287 > 101.20.17.100.80: S 19608494:19608494(0) win 8192 (DF)

 

 

tcpdump -i internal -n host 101.20.17.25 and port 80

 

12:03:59.218600 101.20.17.25.1287 > 192.19.20.1.80: S 19608494:19608494(0) win 8192 (DF)

 

 

My client is 101.20.17.25 and my vip is 101.20.17.100. My pool member is 192.19.20.1

 

I get that the vip translates the dest. to the pool member but where I'm confused is with the SYN being the same on the internal and external.

 

 

Thanks for the help!