For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Matt_M_62913's avatar
Matt_M_62913
Icon for Nimbostratus rankNimbostratus
Dec 10, 2012

Heuristic for sysStatHttpRequests?

We are seeing a lot of connections that are not HTTP and that we don't have an ready explanation for. I am getting the number for non-HTTP traffic by getting the total new connections from sysStatC...
management
monitoring
Matt_M_62913's avatar
Matt_M_62913
Icon for Nimbostratus rankNimbostratus
Dec 10, 2012
Clients can reuse the same TCP connection to send multiple requests, so I'm not sure you'll be able to get a simple count of non-HTTP connections using these two metrics.

 

 

Good point, but that would imply that Connections get undercounted compared to HTTP requests. Here's the type of numbers we are seeing:

 

 

New Connections: 14,200 / second

 

HTTP Requests: 7,948 / second

 

 

Which leaves about 6,200 new connections that are not HTTP, and these servers should not really be seeing any non-HTTP traffic, except for an occasional SSH connection.

 

 

There is a lot of request/response traffic over cURL, but that all goes to port 80, so I was thinking it should be counted in the HTTP totals -- Thus my original question. I will need to take a look at the HTTP profile. FWIW, my prime responsibility is the servers behind the F5 - another person actually manages our F5's.

 

 

Can you look at virtual servers without an HTTP profile to get the non-HTTP connection counts?

 

 

Not easily. All the servers behind the F5 are serving HTTP traffic - I don't think we have any virtual servers set up without the HTTP profile, except for the afrementioned SSH traffic, but that totals up to a few connections per day, not per second, so it should not affect the math much at all.