Passive HTTP capture

Question

We have a requirement to capture all the HTTP request and response passively without impacting live systems for analysis. I looked at Pion, tealeaf for instance but wondering if F5 provides any such solution. If not then could you recommend some other lite weight products?

l4l7_53191 · Answer

ExtraHop, but then again I'm quite biased :) 
&nbsp;  
&nbsp; No matter which way you go, you'll want to use taps or SPANs as a low-impact way to keep track of things.  
&nbsp;  
&nbsp; --Matt

hoolio · Answer

Hi Manc, 
&nbsp;  
&nbsp; Extrahop would be a very capable option for this.  Else, if you want more basic cloning of HTTP requests, you could use a High Speed Logging iRule or request logging profile: 
&nbsp;  
&nbsp; Manual Chapter: Using the Request Logging Profile 
&nbsp; https://support.f5.com/kb/en-us/products/wa/manuals/product/wa-implementations-11-2-0/21.html 
&nbsp;  
&nbsp; Log Tcp And Http Request Response Info Remotely  
&nbsp; https://devcentral.f5.com/wiki/iRules.Log-Tcp-And-Http-Request-Response-Info-Remotely.ashx 
&nbsp;  
&nbsp; High Speed Logging should be a very low overhead way to syslog off the HTTP requests to a remote host. 
&nbsp;  
&nbsp; Aaron

Forum Discussion

Passive HTTP capture

2 Replies

Win Big in Vegas: The iRules Contest is back with $5k on the line at AppWorld 2026

Jürgen - February 2026 Featured Member

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

DNS topology not distributing as expected

Unable to Forward APM and AFM Logs to AWS CloudWatch Using Telemetry Streaming

which virtual server will be hit?

Questions on device trust

Restore configuration to GTM Sync Group device

Related Content

Decrypting BIG-IP Packet Captures Automatically

Decrypting BIG-IP Packet Captures without iRules

decrypted tcpdump capture without using an iRule and without using tshark

F5 HTTPS Redirect 2025

DevCentral Connects hosts Capture the Flag!

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS