Can I capture TCP Reset in iRules?

Well, the CLIENT_CLOSED or SERVER_CLOSED event will trigger, however, there isn't a command that will return the reason for the close (whether idle_timeout, FIN, or RST). Maybe rapmaster_c knows of something tricky we can do with the existing set of TCP commands...

Sorry, there's no good way right now to catch a connection closing with a RST as opposed to a 4-way close. One thing we've seen quite a bit of on the internet is upstream proxies that seem to tear down all connections with RSTs rather than properly 4-way close. This may be due to a very short (non-existent?) close-wait timeout on their stacks, so a rule event to distinguish between orderly 4-way closes, and RST-driven teardowns might cause a number of false alarms.

 

 

If this is something you absolutely must have, please contact support, and we'll see what we can do to have an enhancement CR put in the pipe.

It looks like someone was trying to figure this out several years ago. Has F5 been able to find a way to capture TCP Resets in an iRule now? It seems like a rather common question.

It looks like someone was trying to figure this out several years ago. Has F5 been able to find a way to capture TCP Resets in an iRule now? It seems like a rather common question.

No, we still don't have any commands specific to TCP flags or IP data.