For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Mar 22, 2015

How to prove non-http traffic?

Hello Folks, Customer has approximately 80 HTTP/HTTPs Virtual servers configured on his BIG-IP appliance, and it is showing the following log message under LTM log. http_process_state_prepend -...
application delivery
LTM
non-standard http
swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Mar 22, 2015

Thanks Nitass,

 

The script looks reactive, can it be pro-active? Rather waiting for the occurrence to happen, can we always run the TCPDUMP, let's 5 copies should be saved under /var/tmp and each copy should have 1000 packets (using -c), and when it sees the particular message, stop the script after getting another 1000 packets, to capture the complete the flow.

 

Possible?

 

Thanks,

 

nitass's avatar
nitass
Icon for Employee rankEmployee
Mar 22, 2015
i think you can run tcpdump continuously using -C (capital c) and -W (capital w) and stop tcpdump when seeing log message using icall or /config/user_alert.conf.