For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

astokes_6920's avatar
astokes_6920
Icon for Nimbostratus rankNimbostratus
Nov 10, 2009

HTTP monitor with HEAD, not GET

While using the following monitor, I'm finding that the web servers are keeping TCP sessions in the TIME_WAIT state, rather than closing them outright.     GET /serverin.html HTTP/1.1\r\nCo...
management
monitoring
astokes_6920's avatar
astokes_6920
Icon for Nimbostratus rankNimbostratus
Nov 11, 2009
Thanks for that advice. I applied your suggestion of removing the two explicit CRLF earlier today, but checking back in three hours later, a "netstat -n" on the IIS server still shows over 3000 connections in TIME_WAIT.

 

 

GET /serverin.html HTTP/1.1\r\nConnection: Close\r\nHost:

 

 

The receive string is still simply a 200 OK.

 

 

HTTP/1.1 200 OK

 

 

My LTM is currently running 9.4. Our web servers are on Windows 2K3, with IIS 6.0.

 

I've done a TCP dump on the LTM and it looks like the FIN bit is set in the server response.

 

 

I guess my next step is to do a packet capture with Wireshark for some more detailed output, and see that the Close is in the HTTP header sent by the LTM. If I see anything out of the ordinary, I'll post it here.

 

 

Thanks again.