For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Stefan_Hill's avatar
Stefan_Hill
Icon for Nimbostratus rankNimbostratus
Jan 16, 2015

LTM 11.4.1 forwarding to Netscaler 10.5 with ssl offloading and inspection

Hello   I have the following scenario. My citrix clients are connecting over F5 to a netscaler. Behind the netscaler is the whole environment with StoreFront 2.6 etc. The F5 is doing ssl offloadin...
application delivery
ASM Advanced WAF
LTM
security
StephanManthey's avatar
StephanManthey
Icon for Nacreous rankNacreous
Jan 27, 2015

Hi Stefan,

as WLB already recommended, a TCPDUMP may help to find out the issue: 

tcpdump -nnni 0.0:nnnp -s 0 -w /shared/issue.cap host

It will trace all client- and serverside traffic initiated by your client.

The tcpdump syntax above is adding the so called "F5 Ethernet Trailer" data (the "nnn"-flag in the interface definition) to your raw dump file /shared/issue.cap and contains as well the related traffic on "peer" side (server side; triggered by the "p"-flag in the interface definition).

Description of and required WireShark plugin to decode the trailer data can be found here on DevCentral.

Thanks, Stephan