For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

shobi1_329850's avatar
shobi1_329850
Icon for Nimbostratus rankNimbostratus
Aug 08, 2017

How do I view which rule closed a TCP connection?

We are trying to troubleshoot an issue that is very puzzling to us. The symptom...when we fail over to another site of ours with F5 configs fully sync'd with the working size we see TCP resets origi...
application delivery
BIG-IP
iRules
Ed_Summers's avatar
Ed_Summers
Icon for Nimbostratus rankNimbostratus
Aug 08, 2017

You've checked all the basic issues such as connectivity (routing, ACLs, etc.) and verified that the resets are indeed originating from the BIG-IP? K9812 reviews some common reasons for resets from BIG-IP.

 

K13233 describes how to enable logging to /var/log/ltm or inside the TCP RST packet itself. Note the warnings about performance degradation and consider your environment.

 

K13637 describes how to increase the 'noise level' in a tcpdump from BIG-IP. The 'medium' details includes the reset cause.