Forum Discussion

manc_63343's avatar
manc_63343
Icon for Nimbostratus rankNimbostratus
Jun 23, 2012

Passive HTTP capture

We have a requirement to capture all the HTTP request and response passively without impacting live systems for analysis. I looked at Pion, tealeaf for instance but wondering if F5 provides any such solution. If not then could you recommend some other lite weight products?

 

config
design
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Jun 24, 2012
    ExtraHop, but then again I'm quite biased :)

     

     

    No matter which way you go, you'll want to use taps or SPANs as a low-impact way to keep track of things.

     

     

    --Matt
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jun 26, 2012
    Hi Manc,

     

     

    Extrahop would be a very capable option for this. Else, if you want more basic cloning of HTTP requests, you could use a High Speed Logging iRule or request logging profile:

     

     

    Manual Chapter: Using the Request Logging Profile

     

    https://support.f5.com/kb/en-us/products/wa/manuals/product/wa-implementations-11-2-0/21.html

     

     

    Log Tcp And Http Request Response Info Remotely

     

    https://devcentral.f5.com/wiki/iRules.Log-Tcp-And-Http-Request-Response-Info-Remotely.ashx

     

     

    High Speed Logging should be a very low overhead way to syslog off the HTTP requests to a remote host.

     

     

    Aaron