For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

BrianG_11931's avatar
BrianG_11931
Icon for Nimbostratus rankNimbostratus
May 23, 2014

Extended Content Verification (ECV) Content Check HTTP Health Monitor Receive String (2)

Hello, I created an Extended Content Verification (ECV) Content Check Health Monitor to test server-specific content returned from a web server query, but it's currently not working (never has), and ...
application delivery
availability
deployment
LTM
nitass's avatar
nitass
Icon for Employee rankEmployee
May 29, 2014

Packet analysis showed "400 Bad Request" & "Bad Request - Invalid Header" messages, but I'm not an expert at reading packets.

 

you may try tcpdump when using curl and compare with the health monitor's tcpdump. look for request packet and see what difference is. then modify the health monitor send string accordingly.

 

  • BrianG_11931's avatar
    BrianG_11931
    Icon for Nimbostratus rankNimbostratus
    May 29, 2014
    Hello, I ran a tcpdump on the BIG-IP while also running a curl on the BIG-IP. I didn't see anything more helpful except I see both an "HTTP/1.1 400 Bad Request" and an "HTTP/1.1 302 Found" in the same capture. I don't know what you want me to compare with a previous tcpdump of just a health monitor's traffic as they look the same to me. What does a "request packet" look like and if I use Wireshark to look at the capture, where should I be looking in the packet for data to compare? Thanks