get_al_active_connections() crashes iControlPortal.cgi

Thanks for the reply. I agree that mirroring traffic somewhere else and using another utility to create the connection counts would work best, but the timeline is the major consideration (mgmt. wants this up in the next day or two). If we do eventually go that route, we would want to utilize layer 7 information to do additional filtering (e.g. filter OUT any connections that have "normal" user-agent strings) so we would likely be doing more than just counting connections but I think utilities like snort can provide this information rather natively.

 

 

The difficult part polling this information is in obtaining connection rate information. Since I am only able to see a current snapshot of the connection table and will inevitably have a relatively large window between polls, knowing how many connections per second a client is establishing will be impossible. That being said we'll attempt to use some statistical analysis to derive that metric.

 

 

On a slightly different note, my plan to "persist" suspect clients to a single back end node will be possible if I am able to manually alter the persistence table via iControl. Is this the best way to go about this and is there an easy way to specify which node a client will "stick" to?

 

 

Thanks again. This has been a very enlightening discussion.

 

 

Will