Can I capture TCP Reset in iRules?

Sorry, there's no good way right now to catch a connection closing with a RST as opposed to a 4-way close. One thing we've seen quite a bit of on the internet is upstream proxies that seem to tear down all connections with RSTs rather than properly 4-way close. This may be due to a very short (non-existent?) close-wait timeout on their stacks, so a rule event to distinguish between orderly 4-way closes, and RST-driven teardowns might cause a number of false alarms.

 

 

If this is something you absolutely must have, please contact support, and we'll see what we can do to have an enhancement CR put in the pipe.