Forum Discussion
fluzocapacitor
Altocumulus
AltocumulusIssue with Capturing SYN-ACK Packets on F5 BigIP Virtual Server
Hello everyone, I have a virtual server set up on an F5 BigIP. I captured traffic on a client (IP: 10.16.x.x) of the balanced service and on the virtual server itself (IP: 10.16.y.y). On the client ...
zamroni777
Nacreous
Nacreousf5 bigip is basically proxy.
client side and server side are handled separately.
you probably has oneconnect enabled so bigip may reuse a server side tcp connection for multiple client sessions
fluzocapacitorAltocumulus
AltocumulusThank you for your response.
I understand that F5 BigIP acts as a proxy, handling client-side and server-side connections separately. However, my concern is that, even with this behavior, the F5 should establish the connection with the client.
In the client-side traffic capture, I see the SYN packet from the client, but I do not see the SYN-ACK packet from the F5 to the client. Given this situation:
- Shouldn't I see the SYN-ACK packet from the F5 to the client in my server-side capture?
- Is there any specific reason why the SYN-ACK packet might not appear in the capture?
For reference, here is the command I used to capture the traffic:
/usr/sbin/tcpdump -s0 -ni any:nnn -w /var/tmp/proxy80.pcap host 10.16.y.y and host 10.16.x.x
Could it be possible that my capture command is incorrect, or is there something else I should consider?
Thank you for your assistance!