Determine source IP addresses of SSLv3 connections?

not sure if there are any stats on this you can query, but here is an irule that will log the connections to /var/log/ltm

when CLIENTSSL_HANDSHAKE {
    if { [SSL::cipher version] eq "SSLv3" } {
        log local0.debug "[IP::client_addr] accessed [virtual name] with SSLv3"
    }
}

This assumes you have a client_ssl profile on the virtual server. If not, you would have to modify the script at https://devcentral.f5.com/articles/irule-to-stop-sslv3-connections to just log instead of reject.

I have a slightly more detailed logging rule that provides some additional information if required.

when HTTP_REQUEST {

if { [info exists logged] && $logged == 1 }{
     Do nothing. Already logged for this connection
} else {
    set logged 1
    log "Rule CIPHER_logging fired, from [IP::remote_addr] to vip [IP::local_addr] Cipher [SSL::cipher name]:[SSL::cipher version]:[SSL::cipher bits] Client:[HTTP::header "User-Agent"]:[HTTP::host]"
}
}

mimlo, David,

That looks promising. Appreciate your quick responses. Many thanks!.