Forum Discussion

Doris_Ramirez_2's avatar
Doris_Ramirez_2
Icon for Nimbostratus rankNimbostratus
May 16, 2011

Capture TCP Reset with iRule?

Hi, can you help me?   I need to capture in LTM v10 all TCP request, TCP Reset and TCP Establishment that are generated by Clients... the same information that I see with a tcpdump but I need to ca...
application delivery
dev
devops
iRules
hooleylist's avatar
hooleylist
Icon for Cirrostratus rankCirrostratus
May 17, 2011
Hi Doris,

It's not currently possible to access the TCP flags from an iRule. You could log when a TCP connection from a client to a virtual server from the CLIENT_ACCEPTED event: 


when CLIENT_ACCEPTED {

    Log locally or remotely that a connection was established
    http://devcentral.f5.com/wiki/default.aspx/iRules/log
   log local0. "[IP::client_addr]:[TCP::client_port]: Connection to [IP::local_addr]:[TCP::local_port] on [virtual name]"
}

You can read the options from the TCP headers, but this doesn't include the TCP flags that you're looking for.

http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086447/Accessing-TCP-Options-from-iRules.aspx

Aaron