Forum Discussion
LTM Throttling Proxied Connections in 20 second intervals
- Oct 18, 2018
It turns out this was a faulty OSCP server upstream that was causing certificate checking to fail. The solution was to remove OSCP from our APM access policy until we can find another, better solution. Thanks everyone for the help!
Maybe a HTTP profile added to vip it will wait for at least one http message from the client before opening the server side connection.
do a tcpdump with the -p filter to capture both sides of the connection client to vip - f5 to server.
example "tcpdump -nni 0.0:nnnp -s 0 host X.X.X.X and host X.X.X.X"
- MikeG_331443Aug 30, 2018Altostratus
Thanks for replying! We do have an HTTP profile but I'm not sure what you mean by adding it to a vip (did you mean vs?). It uses the default http parent profile and the only option we've enabled is "Insert X-Forwared-For". I dug around in there but can't find anything that would limit each proxied message to exactly 20 seconds.
- KevinA_246454Aug 30, 2018Cirrostratus
Hi Mike
I have never seen any material from f5 that indicates a delay of 20 seconds per packet, and yes I meant vs. a standard vs with a http profile will result the vs will complete the 3 way handshake with the client and at wait for a http request from the client before opening up the connection on the server side. but even that will surely not cause a 20 seconds delay.
Like I mentioned you can try to do a tcpdump on the f5 with the -p filter does will allow you analyze traffic from both client to vs and f5 to server. you will then be able to see when the f5 receive the 1st syn or http request and the time difference since the request is made to backend server.
- MikeG_331443Aug 30, 2018Altostratus
Thanks Kevin, I will keep trying with the tcpdump and your suggested settings. It's a bit hard to troubleshoot because we can't trigger the event due to the data coming in from an external source on a random schedule. It's definitely odd because it "should" fire everything to the backend as soon as it received but you could set your watch to the 20 second interval, it's that precise. Was hoping it was just a 20s congestion queue setting somewhere I haven't found yet. Thanks for your help!
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com