Forum Discussion

Gopal123's avatar
Icon for Nimbostratus rankNimbostratus
Feb 01, 2024

Need help regarding F5 LTM iRule

Hi Team,


We have a legacy virtual server configured with no pool members, but a iRule is tagged under the VIP.

If anyone can help me to find a way that I can find whether actually that VIP is currently getting used or not.


From local traffic logs I can see that particular iRule is getting accessed, but not sure if this is the correct way to find the information I'm looking into.


Thanks in advance.


2 Replies

  • Gopal123 You should be able to go into the VS statistics page and reset them to zero to see if it's being hit. If you can provide the iRule in question I'm sure we can recommend specific lines to add logging in order to say if it's being used or not.

  • Hi, 

    you have multiple ways: 

    • The most perfect one is to take a Packet capture and have a look on it, try the below command: 
      • tcpdump -vvnni 0.0:nnnp host <your_IP> -s0 -vw /var/tmp/TestVS.pcap
        tcpdump -vvnni 0.0:nnnp host <VS_IP> -s0 -vw /var/tmp/TestVS.pcap

      • use one of those commands you'll be able to see the client/server-side connections that hit this virtual server also you will see which pool selected for each connection.
    • another Perfect way and easiest one, you can use display the active connections, using the below command: 
      • tmsh show /sys connection cs-server-addr <vs_ip> cs-server-port <vs_port>
      • look at these articles explain this command:
      • Consider using filters when using show sys connection command , don't run just " show sys connections " because in production environment it will give you huge amount of connections and you don't need them also it affects the device performance , so please use Filters like I used in the command above you can use ( VS IP or Client IP "source" ) in the first article you can navigate all filters/options that is used with this command. 
    • you can also Reset all stats and check VS and Pools stats to validate that the VS receiving connections, but I prefer the first two methods.