For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Deb_Allen_18's avatar
Deb_Allen_18
Historic F5 Account
Aug 11, 2006

Capturing TCP resets (part deux)

Click here

 

 

I found this post about catching TCP RST, and was wondering if we can do more now, and also hoping to find out more about connection management behaviour with OneConnect.

 

 

1) Has anything like "IP::payload" or "TCP::flags" been added since then?

 

 

2) If the server sends a RST on a OneConnect connection, does it trigger SERVER_CLOSED? CLIENT_CLOSED? I'm assuming the server side connection is closed and re-opened?

 

 

thanks!

 

/deb
application delivery
dev
devops
iRules

3 Replies

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Oct 10, 2006
    Did you get an offline answer to this deb? We are having an issue where we're trying to correlate apache 502 responses to the clients to errors in our application tier, and have been unable to do so.
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Oct 11, 2006
    No, sorry -- I'm still in the dark on this one.

     

     

    Something like [IP::payload] would sure come in handy for a number of things I've touched recently, though.

     

     

    I suppose I should see if there's a CR for that yet, and open one if not...

     

     

    /deb
  • unRuleY_95363's avatar
    unRuleY_95363
    Historic F5 Account
    Oct 19, 2006
    Sorry, no is the answer for 1).

     

     

    As for 2), yes I would expect SERVER_CLOSED to get triggered. Also, I believe that the RST is propagated to any currently connected client, so I would expect CLIENT_CLOSED to get triggered if there's actually a client connected at the time of the RST.