Forum Discussion

lieweffect_3313's avatar
lieweffect_3313
Icon for Nimbostratus rankNimbostratus
Sep 27, 2018

How to packet capture the whole traffic flow in VIP by Automap

Hi,

 

I do have a VIP configured using Automap. 2 nodes on the pool member.

 

Now, the problem is the log on the nodes member will always show the self IP as a source IP address. Configure X-forwarded will not work for my application due the the network setup.

 

I try packet capture with command: tcpdump -ni 0.0:nnnp -s 0 host or port -w /var/tmp/test.pcap

 

On Wireshark, if follow the TCP stream, it won't show the full traffic flow. It just either "self IP and node IP" or "actual source IP and VIP"

 

How to capture/filter the packet so that I can have a full set of the traffic flow?

 

application delivery
BIG-IP
LTM
packet analysis
packet capture
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Sep 27, 2018

    Hi,

    since you are capturing on the ip address base, keep in mind that capture from F5 to backend you may have several user session if you are not the only one to test (because of snat):

    tcpdump -nni 0.0 '(host "clientIP" and host "VipIP")' or  '(host "FloatinIP" and host "BackendServer")'

    or

    tcpdump -nni 0.0 '(src host "clientIP" and dst host "VipIP")' or  '(src host "FloatinIP" and dst host "BackendServer")'

    In your situation I advise you to capture traffic using an Irule, it allows you to go up to layer 7 and capture traffic end-to-end for a single user.

    let me know if you need assistance for irule

    Regards