For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

fayar_128903's avatar
fayar_128903
Icon for Nimbostratus rankNimbostratus
Jul 25, 2013

Internal loopback & node connection

Hello,

I need a little help regarding the "internal routing" of the F5.

As my understanding, there is internal connections established between different components of the F5 (tmm instances, sccp, host, etc..) on the 127/8 network.

However, here I have this behaviour (extract of netstat -pan) :


tcp        0      0 ::ffff:127.1.1.1:36568      ::ffff:10.X.X.X:24950   TIME_WAIT  
tcp        0      0 ::ffff:127.1.1.1:60952      ::ffff:10.X.X.X:22943   TIME_WAIT  
tcp        0      0 ::ffff:127.1.1.1:59140      ::ffff:10.X.X.X:27000   TIME_WAIT  
tcp        0      0 ::ffff:127.1.1.1:35971      ::ffff:10.X.X.X:24950   TIME_WAIT  
tcp        0      0 ::ffff:127.1.1.1:35372      ::ffff:10.X.X.X:24950   TIME_WAIT  

The IP in 10.X are nodes.

I've checked on other devices, located on other architecture, but each times the connections on the 127/8 network were only internals, never on external hosts. Like, for exemple :

tcp 0 0 127.0.0.1:9784 127.0.0.1:37290 ESTABLISHED

tcp 0 0 127.0.0.1:7777 127.1.1.2:41599 ESTABLISHED

tcp 0 0 127.0.0.1:49766 127.0.0.1:8009 TIME_WAIT

tcp 0 0 127.0.0.1:9167 127.0.0.1:37289 ESTABLISHED

tcp 0 0 127.0.0.1:39838 127.0.0.1:9783 ESTABLISHED

The connections on the nodes in "normal behaviour" were using the selfip (for monitoring, for exemple).

We also have a lot of reset on this appliance (a service request has been raised on this issue), but I wonder if this behaviour could be linked.

Has someone already saw this behaviour ?

Thanks a lot !

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus

    Hi Fayar,

     

    Which LTM version are you seeing this on?

     

    Do you have pool members on the ports listed in the netstat output (example: 10.X.X.X:24950)?

     

    What's the daemon listed for 127.1.1.1 in the netstat -nap output?

     

    Aaron