For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brandon's avatar
Brandon
Icon for Cirrostratus rankCirrostratus
Apr 22, 2019

insert_xforwarded verification

I have enabled insert_xforwarded oh the Http profile of the VIP.

 

I wanted to verify the F5 was working correctly. What is the best way to verify packet capture or a logging iRule? any examples would be appreciated.

 

Thanks,

 

Brandon

 

application delivery
iRules
LTM

1 Reply

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    May 18, 2019

    The easiest is to tcpdump the traffic (Or ssldump if it's encrypted).

    On the bigip it'd be something like

    tcpdump -i 0.0 -nn  -e -s0 -X host BACKEND_IP_ADDR and port BACKEND_PORT

    -i == specie the interface. 0.0 will snoop all interfaces

    -nn == don't translate ip's or ports to names

    -e == print the link level header when dumping the traffic

    -s0 == capture all packets. Default is just the first 64

    -X == dump the packet as ASCII not just numbers

    The rest is the filter. We want packets that are to/from the backend host and on the port you're talking to.