Forum Discussion
How to Capture everything related to specific VIP
Hi Team ,
I have a https vip with client-ssl and default cookie persistence profile ,http,tcp profile configured . I would like to capture all the traffic and connection related to this specific VIP only . How can I achieve it ?
Can you please share the irule or policy configuration to achieve this ?
Below commend will help to capture the traffic details towards VIP. iRule may not help to capture live connection count.
tmsh show sys connection | grep <VIP_IP> ==> Current conenction towards to VIP tmsh show ltm persistence persist-records virtual <VIP_NAME> ==> F5 LTM session table for your VIP
- Blue_whale
Cirrocumulus
This is live log collection . I need historical logs to be captured .
- Lidev
Nacreous
You can also deep dive with this tmsh command:
show sys connection cs-client-addr x.x.x.x cs-server-addr y.y.y.y ss-server-addr z.z.z.z ss-server-port 443
cs-client-addr - the (client) source IP address on the clientside of the connection. cs-client-port - the (client) source port on the clientside of the connection. cs-server-addr - the (server) destination IP address on the clientside of the connection (i.e. the Virtual Server IP address). cs-server-port - the (server) destination port on the clientside of the connection (i.e. the Virtual Server port). ss-client-addr - the (client) source IP address on the serverside of the connection (i.e. the SNAT address). ss-client-port - the (client) source port on the serverside of the connection (i.e. the SNAT port). ss-server-addr - the (server) destination IP address on the serverside of the connection (i.e., the Pool Member address). ss-server-port - the (server) destination port on the serverside of the connection (i.e., the Pool Member port).
- Blue_whale
Cirrocumulus
This is live log collection . I need historical logs to be captured .
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com