For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

atuls_7180's avatar
atuls_7180
Icon for Nimbostratus rankNimbostratus
Jan 12, 2012

Interpreting time-taken IIS log field in load balanced configuration

We are using BIG-IP LTM to load balance between application servers which are running IIS 7.0. Our system is configured to offload SSL to BIG-IP LTM. Our application servers handle compression. I hav...
config
design
nitass's avatar
nitass
Icon for Employee rankEmployee
Jan 12, 2012
i understand client sends FIN and then bigip sends it to server (pool member). 

[root@ve1023:Active] config  b virtual bar list
bvirtual bar {
   snat automap
   pool foo
   destination 172.28.19.79:80
   ip protocol 6
   profiles {
      http {}
      tcp {}
   }
}
[root@ve1023:Active] config  b pool foo list
pool foo {
   members 200.200.200.101:80 {}
}
[root@ve1023:Active] config  b self 200.200.200.10 list
self 200.200.200.10 {
   netmask 255.255.255.0
   vlan internal
   allow default
}

[root@ve1023:Active] config  tcpdump -nni 0.0 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 108 bytes
20:43:47.571707 IP 172.28.19.253.49977 > 172.28.19.79.80: S 3323959709:3323959709(0) win 5840 
20:43:47.571760 IP 172.28.19.79.80 > 172.28.19.253.49977: S 1166530685:1166530685(0) ack 3323959710 win 4380 
20:43:47.575553 IP 172.28.19.253.49977 > 172.28.19.79.80: . ack 1 win 46 
20:43:47.575610 IP 172.28.19.253.49977 > 172.28.19.79.80: P 1:155(154) ack 1 win 46 
20:43:47.576607 IP 200.200.200.10.49977 > 200.200.200.101.80: S 1870686982:1870686982(0) win 4380 
20:43:47.577501 IP 200.200.200.101.80 > 200.200.200.10.49977: S 2801000415:2801000415(0) ack 1870686983 win 5792 
20:43:47.577513 IP 200.200.200.10.49977 > 200.200.200.101.80: . ack 1 win 4380 
20:43:47.577530 IP 200.200.200.10.49977 > 200.200.200.101.80: P 1:155(154) ack 1 win 4380 
20:43:47.578452 IP 200.200.200.101.80 > 200.200.200.10.49977: . ack 155 win 54 
20:43:47.580643 IP 200.200.200.101.80 > 200.200.200.10.49977: P 1:372(371) ack 155 win 54 
20:43:47.580670 IP 172.28.19.79.80 > 172.28.19.253.49977: P 1:372(371) ack 155 win 4534 
20:43:47.583720 IP 172.28.19.253.49977 > 172.28.19.79.80: . ack 372 win 54 
20:43:47.583732 IP 172.28.19.253.49977 > 172.28.19.79.80: F 155:155(0) ack 372 win 54 
20:43:47.583743 IP 172.28.19.79.80 > 172.28.19.253.49977: . ack 156 win 4534 
20:43:47.583749 IP 200.200.200.10.49977 > 200.200.200.101.80: F 155:155(0) ack 372 win 4751 
20:43:47.584686 IP 200.200.200.101.80 > 200.200.200.10.49977: F 372:372(0) ack 156 win 54 
20:43:47.584700 IP 200.200.200.10.49977 > 200.200.200.101.80: . ack 373 win 4751 
20:43:47.584704 IP 172.28.19.79.80 > 172.28.19.253.49977: F 372:372(0) ack 156 win 4534 
20:43:47.586583 IP 172.28.19.253.49977 > 172.28.19.79.80: . ack 373 win 54