Forum Discussion
SanYang
Cirrus
CirrusHow to check the source IP of an "open connection" ?
Hello,
Recently, the F5 I manage was suspected to be under attack.
There were as many as 650 K "open connections" and I wanted to check the source IP of these connections.
I tried "tmsh show sys connection" and found that it only shows up to 1000 connections.
What else can I do?
Any help is appreciate.
- Lucas_Thompson
Employee
Luckily BIG-IP is pretty flexible in this area.
- You can filter out connections. "tmsh show sys conn" supports a lot of different filter selectors that you can use: https://my.f5.com/manage/s/article/K53851362
- You can change the limit from 1000 to something else: https://my.f5.com/manage/s/article/K20234023
