Forum Discussion
PS_332920
Nimbostratus
NimbostratusBest methods to co-relate the client and server side flows
Team, based on a captured pcap where both client and server side conversations have been captured, could you recommend the best ways to correlate which client side TCP stream for example relates with...
Simon_Blakely
Employee
EmployeeYour flowid filter example will not match a client flow to a server flow.
All you have matched are two independent flows that have reused the same connection table entry.
You need to match the client-side peerid to the server-side flowid (or vice-versa).
Use f5ethtrailer.anyflowid to match on either flowid and peerid values, so for a flow you get to see both sides of the conversation. You will also see the flow-reuse mentioned above, but you can usually see where the flows are very different.
Of course, if flow reuse is in play (i.e OneConnect), you may only see part of the server-side flow, where the required client-side flow is attached.