For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Fantas's avatar
Fantas
Icon for Nimbostratus rankNimbostratus
Oct 02, 2020

F5 Sending Traffic to Port 5051

Hi,   I have noticed on one of our f5 sending traffic to one of the internal server destination port 5051. Captured wireshark , I noticed that traffic is initiated by f5 inside interface to serv...
BIG-IP
cloud
LTM
Fantas's avatar
Fantas
Icon for Nimbostratus rankNimbostratus
Oct 04, 2020

Hi,

 

Yes based on ip address, when I capture traffic based on port 5051 ( without mentioning source / destination hosts), I can see only inside interface ip as source and destination inside server ip , I can see GET request source inside interface to target server.

 

wireshark capture shows , source ip and destination port and server details.

 

 

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Oct 19, 2020

    does the GET make any sense in your environment?

     

    it isn't just a health monitor or such?

  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for Noctilucent rankNoctilucent
    Oct 19, 2020

    Often if you open the last bytes of a packet, you'll see the virtual name at the end, see if this helps. But with nnn you should see more details. Try that too.