Forum Discussion

newf5learner_13's avatar
newf5learner_13
Icon for Nimbostratus rankNimbostratus
Nov 20, 2015

connection resets happening to web services servers when clients uses load balanced url. Need help to capture traffic.

Hi, I'm seeing complaints saying that there are intermittent resets happening when the client uses load balanced url. Out of 60 web request sent from clients in 30 minutes, 8 to 9 requests were get...
application delivery
BIG-IP
deep packet inspection
LTM
tcpdump
newf5learner's avatar
newf5learner
Icon for Nimbostratus rankNimbostratus
Nov 20, 2015

thanks. other than the command to capture the resets (the above command is not working - I tired multiple times on a busy LTM), can you please suggest how to capture traffic using some compound statements using source, destination servers and on port 80.

I have even tried this 

tcpdump '( tcp[tcpflags] & (tcp-rst) != 0) and host 10.196.1.119'     but I'm seeing no traffic even though I reset the connection from browser. 

tcpdump -ni 0.0 src host 10.194.232.2 and '(dst host 10.194.232.127 or dst host 10.194.232.134)'

10.194.232.2 is the Internal self IP address which is interacting with servers. however its capturing the health monitor traffic also. Please suggest me how to filter out only my active client connection related traffic but not the health monitor one.

Please suggest. thanks.