For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kudakwashet_154's avatar
kudakwashet_154
Icon for Nimbostratus rankNimbostratus
May 20, 2014

Hi here is the tcpdump output

login as: root

Using keyboard-interactive authentication.

Password:

Last login: Mon May 19 15:56:31 2014 from 10.10.168.14

[root@imm:Active:In Sync] config tcpdump -i 1.2

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on 1.2, link-type EN10MB (Ethernet), capture size 96 bytes

12:39:25.593191 arp who-has 10.10.168.14 tell 10.10.168.3

12:39:25.778927 802.1d config 8001.58:0a:20:2e:f5:80.8010 root 8001.58:0a:20:2e:f5:80

pathcost 0 age 0 max 20 hello 2 fdelay 15

    0x0000:  0180 c200 0000 580a 202e f590 8100 0000  ......X.........

    0x0010:  0026 4242 0300 0000 0000 8001 580a 202e  .&BB........X...

    0x0020:  f580 0000 0000 8001 580a 202e f580 8010  ........X.......

    0x0030:  0000                                     ..

12:39:26.360575 arp who-has 10.10.168.2 tell 10.10.168.3

12:39:26.592416 arp who-has 10.10.168.14 tell 10.10.168.3

12:39:26.592992 arp who-has 10.10.168.13 tell 10.10.168.3

12:39:27.360060 arp who-has 10.10.168.2 tell 10.10.168.3

12:39:27.591887 arp who-has 10.10.168.13 tell 10.10.168.3

12:39:27.591902 arp who-has 10.10.168.14 tell 10.10.168.3

12:39:27.783073 802.1d config 8001.58:0a:20:2e:f5:80.8010 root 8001.58:0a:20:2e:f5:80

pathcost 0 age 0 max 20 hello 2 fdelay 15

    0x0000:  0180 c200 0000 580a 202e f590 8100 0000  ......X.........

    0x0010:  0026 4242 0300 0000 0000 8001 580a 202e  .&BB........X...

    0x0020:  f580 0000 0000 8001 580a 202e f580 8010  ........X.......

    0x0030:  0000                                     ..

12:39:28.591791 arp who-has 10.10.168.14 tell 10.10.168.3

12:39:28.591800 arp who-has 10.10.168.13 tell 10.10.168.3

12:39:29.259011 arp who-has 10.10.168.13 tell 10.10.168.2

12:39:29.359354 arp who-has 10.10.168.2 tell 10.10.168.3

12:39:29.591549 arp who-has 10.10.168.13 tell 10.10.168.3

12:39:29.591566 arp who-has 10.10.168.14 tell 10.10.168.3

12:39:29.787288 802.1d config 8001.58:0a:20:2e:f5:80.8010 root 8001.58:0a:20:2e:f5:80

pathcost 0 age 0 max 20 hello 2 fdelay 15

    0x0000:  0180 c200 0000 580a 202e f590 8100 0000  ......X.........

    0x0010:  0026 4242 0300 0000 0000 8001 580a 202e  .&BB........X...

    0x0020:  f580 0000 0000 8001 580a 202e f580 8010  ........X.......

    0x0030:  0000                                     ..

12:39:30.258722 arp who-has 10.10.168.13 tell 10.10.168.2

12:39:30.258847 arp who-has 10.10.168.14 tell 10.10.168.2

12:39:30.359289 arp who-has 10.10.168.2 tell 10.10.168.3

12:39:30.590876 arp who-has 10.10.168.14 tell 10.10.168.3

12:39:30.590893 arp who-has 10.10.168.13 tell 10.10.168.3

12:39:31.258598 arp who-has 10.10.168.14 tell 10.10.168.2

12:39:31.258614 arp who-has 10.10.168.13 tell 10.10.168.2

12:39:31.358922 arp who-has 10.10.168.2 tell 10.10.168.3

12:39:31.590859 arp who-has 10.10.168.13 tell 10.10.168.3

^C

55 packets captured

55 packets received by filter

0 packets dropped by kernel

[root@imm:Active:In Sync] config tcpdump -i 1.3

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on 1.3, link-type EN10MB (Ethernet), capture size 96 bytes

^C

0 packets captured

0 packets received by filter

0 packets dropped by kernel

[root@imm:Active:In Sync] config tcpdump -i internal

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on internal, link-type EN10MB (Ethernet), capture size 96 bytes

12:43:22.250544 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:22.251585 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:23.250636 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:23.251647 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:24.250551 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:24.251567 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:25.251506 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:29.259969 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:30.259588 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:30.260972 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:31.259491 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:31.260474 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:32.259565 arp who-has 10.10.168.13 tell 10.10.168.2

12:43:32.260622 arp who-has 10.10.168.14 tell 10.10.168.2

12:43:33.259497 arp who-has 10.10.168.13 tell 10.10.168.2

^C

28 packets captured

28 packets received by filter

0 packets dropped by kernel