HTTP Post across Mutiple TCP Segment

Hello Mohit.

​

There is no possible to fragment packets if you use a http profile.

When you assign a profile to a VS, F5 analyzes if this packet is RFC compliant and parses the whole set of app variables. This doesn't work at all if you divide those packets in several segments.

​

In your case, you should configure a L4 virtual using only tcp profile (no http).

​

KR,

Dario.

L4 (HTTP) work differently than Standard (HTTP). The first one is in read-only mode and does not impact traffic.

https://support.f5.com/csp/article/K16446

​

As I told you, F5 discard traffic which is not HTTP RFC-compliant and I suspect that your device is dealing each packet individually (so the second will be discarded for this reason).

​

Could you clarify better what kind of fragmentation are you experiencing here?

Have both packets got http header (you are using chunking technique) or is it an IP/TCP fragmentation?

​

KR,

Dario.

Then, the reason of this second packet is not sent to the backend is because of the HTTP profile as I mentioned.

​

What's the problem of using L4 virtual in your environment? This will fix the problem.

​

There are some bugs regarding TCP Segmentation. If you want to experiment, I recommend you disable TSO and LRO to force software TCP segmentation processing.

https://support.f5.com/csp/article/K15609

​

Also, you could program your client to use chucking method to send your payload. That will avoid TCP segmentation.

​

KR,

Dario.

 Mohit is explaining that when using activesync, if you send an email larger than TCP MSS (1460 bytes), the HTTP POST data is segmented in multiple TCP packets (TCP segment as explained above). the first contains HTTP headers, following packets only content DATA.

Such packet is supported by F5 if data length across several packets matches "content-length" http header.

I never got issues with such deployments with http profile enabled.

Thanks @Dario Garrido and @Stanislas Piron for feedback.

What Stanislas mentioned is exactly the issue i am facing.

I am using F5 version 12.1.3.1 in which the value of tm.tcplargereceiveoffload is disable ,will enable it in next maintenance window and will retry.

L4 Virtual Server has the same issue and didn't solve the problem.

During further troubleshooting i capture certain parameters. As you can see the content length header field in first image has a value of 393, but when i capture http request from IRULE and paste it in Logs the content length field value is Zero.

I am also attaching tcp dump i capture fro both the incoming and outgoing traffic from F5 Ltm.

862 -469 = 393 thats the excat amount of HTTP Body DATA,

Outgoing traffic

Do you see any error in /var/log/ltm when the issue occurs?

​

BTW, you should also open a support case.

​

KR,

Dario.

The error was resolved.

The issue was​

The HTTP post request from client comes across multiple tcp segments and are coming over port 80. We were using http redirect Irule so the first TCP segment was redirected but when redirected request comes over HTTPS the payload was removed.

Forcing the client ​to always use port 443 resolve the issue.