How to check the source IP of an "open connection" ?

Question

Hello,Recently, the F5 I manage was suspected to be under attack.There were as many as 650 K "open connections" and I wanted to check the source IP of these connections.I tried&nbsp; "tmsh show sys connection"&nbsp; and found that it only shows up to 1000 connections.What else can I do?Any help is appreciate.

lucas_thompson · Answer

Luckily BIG-IP is pretty flexible in this area.

You can filter out connections. "tmsh show sys conn" supports a lot of different filter selectors that you can use: https://my.f5.com/manage/s/article/K53851362
You can change the limit from 1000 to something else:&nbsp;https://my.f5.com/manage/s/article/K20234023

&nbsp;
&nbsp;

Forum Discussion

How to check the source IP of an "open connection" ?

1 Reply

Recent Discussions

Hi All, We have viprion 4300 with 4450 blades with 6 blades all blades having same configuration

BWC iRule

Can iRule be used to perform exception of IPI category based on Geolocation

help irules for compatibilty

Wildcard SSL Certificate Deployment on F5 LTM

Related Content

F5 XC vk8s workload with Open Source Nginx

How to ensure source address and source port are accepted and traversed properly via F5 SNAT automap

F5 XC vk8s open source nginx deployment on RE

The Power of Source Address

iControl Library For Java With Source