For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kbk4912's avatar
kbk4912
Icon for Nimbostratus rankNimbostratus
Sep 20, 2023

Command to check what ip/ips are hitting a specific url on f5 big ip 16.1.3

Need to know if there is a specific command for that, have a use case where i need to check what ips are hitting a url in the last 24 hours.

Thank You

4 Replies

  • can you tell you are looking for a tmsh commnand  to inform you the IP hitting a VIP or you want coomand for hitting a DNS FQDN / URL

     

     

  • the data is only in the logs.   if you are loging it.     connection table only has current active connections. 

  • Hi kbk4912 , 

    you can do that using Irules or LTM policies : 

    1. add event " when HTTP_REQUEST "
    2. put condition for this " URL ".
    3. Log source Ip address when this url be accessed. 
    4. Schedule a time slot to apply this irule , then wait 24 hours.
    5. remove irule , and check all LTM logs and trancated ones as well. 
    6. use filter to filter the output , also you can copy it to another txt file. 
    7. This is the clue I have , unfortunately I can't write the irule script for you now , but this the idea you can search and I am sure you will be able to write it. 

    If you have problems in implementing it , I will try to do it for u in my free time. 
    so keep me updated 🙂 

  • kbk4912  - If your post was solved it would be helpful to the community to select Accept As Solution.
    Thanks for joining and being part of our community.