Forum Discussion

Samurai's avatar
Samurai
Icon for Nimbostratus rankNimbostratus
Sep 08, 2012

SNAT - originating client IP

In a SNAT Pool setup, if you want to find out the client IP connecting to a VIP, is the only way to run tcpdump?

 

If yes, then the tcpsump should be run against all snat pool IPs?

 

 

Thanks

 

management
monitoring
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Sep 08, 2012
    Hi Samurai,

     

     

    If you're using the SNAT pool on a virtual server, you could use an iRule to log the source IP address TMM uses:

     

     

    when SERVER_CONNECTED {

     

    log local0. "Complete connection: Client: [IP::client_addr]:[TCP::client_port]<-> Virtual: [clientside {[IP::local_addr]:[TCP::local_port]}] LTM source [IP::local_addr]:[TCP::local_port] <-> Server: [IP::server_addr]:[TCP::server_port]"

     

    }

     

     

    If you have a lot of connections going through the virtual server, it would be a lot more efficient to use High Speed Logging to send the logs to a remote log server:

     

    https://devcentral.f5.com/wiki/iRules.hsl.ashx

     

     

    Aaron