Forum Discussion

spud_141786's avatar
spud_141786
Icon for Nimbostratus rankNimbostratus
Dec 20, 2014

capturing traffic internal to the F5

If an iRule performs a query against a virtual that is hosted on the same F5, for instance a SOAP call, is it possible to capture that traffic using tcpdump?

 

Since the traffic is not entering or leaving the F5 on a specific interface, it would appear that there is no way for tcpdump to capture this traffic.

 

thanks!

 

application delivery
devops
iRules
LTM

3 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 20, 2014

    have you tried interface 0.0?

    e.g.

     tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 22, 2014

    Much as I love tcpdump... And tcpdump on 0.0 should find it as nitass says above.

     

    However you may be better to try and capture on an analytics profile instead. The analytics profile capture shouldn't be bound by the 200pps limit on tcpdump (Which makes tcpdump a bit hit & miss on a moderately loaded system) SOL6546

     

    There's also a very good SOL note on capturing INTERNAL traffic using tcpdump... SOL13637

     

    H