Forum Discussion

vvskaladhar_488's avatar
vvskaladhar_488
Icon for Nimbostratus rankNimbostratus
Apr 21, 2015

Connection list

HI All,   we are in the phase of decommissioning one of the OLD f5 running with 9.3.0 version. We have already moved all the VIPs to our new load balancer and most of the users are accessing New V...
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous
Apr 21, 2015

Why not use the good old Linux TCPdump? 🙂

tcpdump -nn -i VLANext host 1.1.1.1 -C 200M -w /var/tmp/capture.f5.pcap &

As a background process, this will keep writing 200M size capture files named "capture.f5.pcap" to /var/tmp folder. Replace VLANext with your actual external VLAN; replace 1.1.1.1 with your actual VIP, (or use the "net" flag instead of "host" to specify your VIP range with prefix).

Use the SCP/PSCP/WinSCP to copy files to your PC and open with WireShark. Stopping the background capture:

1. 
ps | grep capture.f5.pcap

2. 
kill
(as found in the output of 1st command)
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous
Apr 21, 2015
With TCPdump you can also write the output to a file (the same command I've posted will do that). Letting the TCPdump collector run for 7 days will get you the information you're looking for. In fact, I don't think there's a good alternative for your case.