For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Mar 22, 2015

How to prove non-http traffic?

Hello Folks, Customer has approximately 80 HTTP/HTTPs Virtual servers configured on his BIG-IP appliance, and it is showing the following log message under LTM log. http_process_state_prepend -...
application delivery
LTM
non-standard http
swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Mar 22, 2015

Thanks Nitass,

 

The script looks reactive, can it be pro-active? Rather waiting for the occurrence to happen, can we always run the TCPDUMP, let's 5 copies should be saved under /var/tmp and each copy should have 1000 packets (using -c), and when it sees the particular message, stop the script after getting another 1000 packets, to capture the complete the flow.

 

Possible?

 

Thanks,

 

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Mar 22, 2015
    i think you can run tcpdump continuously using -C (capital c) and -W (capital w) and stop tcpdump when seeing log message using icall or /config/user_alert.conf.