Forum Discussion

Samurai's avatar
Samurai
Icon for Nimbostratus rankNimbostratus
Sep 08, 2012

SNAT - originating client IP

In a SNAT Pool setup, if you want to find out the client IP connecting to a VIP, is the only way to run tcpdump?   If yes, then the tcpsump should be run against all snat pool IPs?     T...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Sep 08, 2012
Hi Samurai,

 

 

If you're using the SNAT pool on a virtual server, you could use an iRule to log the source IP address TMM uses:

 

 

when SERVER_CONNECTED {

 

log local0. "Complete connection: Client: [IP::client_addr]:[TCP::client_port]<-> Virtual: [clientside {[IP::local_addr]:[TCP::local_port]}] LTM source [IP::local_addr]:[TCP::local_port] <-> Server: [IP::server_addr]:[TCP::server_port]"

 

}

 

 

If you have a lot of connections going through the virtual server, it would be a lot more efficient to use High Speed Logging to send the logs to a remote log server:

 

https://devcentral.f5.com/wiki/iRules.hsl.ashx

 

 

Aaron