Forum Discussion

Jeffrey_Silver1's avatar
Jeffrey_Silver1
Icon for Nimbostratus rankNimbostratus
Oct 09, 2013

I need an irule to log HTTP traffic to SPLUNK to capture the originating IP address before it get's NAT'd

I need to capture original IP addresses for HTTP traffic that passes through an F5 LTM then get's NAT'd. I've read several posts but I am not exactly sure where to begin. I am running 10.2.4.  
application delivery
devops
iRules
Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent
Oct 09, 2013

We do something similar. I'm sure it could be optimized, but it works:

when SERVER_CONNECTED {
  set client_remote "[IP::client_addr]:[TCP::client_port]"
  set client_local  "[IP::local_addr clientside]:[TCP::local_port clientside]"
  set server_local  "[IP::local_addr]:[TCP::local_port]"
  set server_remote "[IP::server_addr]:[TCP::server_port]"
  log local0. "Got connection: Client($client_remote)<->($client_local)LTM($server_local)<->($server_remote)Server"
}