For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jose_fernan_gue's avatar
jose_fernan_gue
Icon for Nimbostratus rankNimbostratus
May 22, 2014

TCP connections on F5 LTM VE

Hi All,   Just want to ask if this is a normal behavior on F5 LTM VE. This is my setup: 1 LTM VE with 2 Linux VE web server. LTM is configured with http and https standard virtual server using the...
application delivery
LTM
management
jose_fernan_gue's avatar
jose_fernan_gue
Icon for Nimbostratus rankNimbostratus
May 22, 2014

Hi,

 

Below are the capture of the tcpdump it seems that the internal vlan ip 10.10.10.1 is the one sending the (R)reset flag

 

23:34:59.063021 IP 10.10.10.1.35840 > 10.10.10.2.http: S 1589453853:1589453853(0) win 5840 23:34:59.065541 IP 10.10.10.2.http > 10.10.10.1.35840: S 3686360985:3686360985(0) ack 1589453854 win 5792 . some output omitted . 23:34:59.098055 IP 10.10.10.1.35840 > 10.10.10.2.http: F 8:8(0) ack 2897 win 91 23:34:59.099024 IP 10.10.10.2.http > 10.10.10.1.35840: P 2897:4097(1200) ack 8 win 5792 23:34:59.099613 IP 10.10.10.1.35840 > 10.10.10.2.http: R 1589453861:1589453861(0) win 0