For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

teknet7_237497's avatar
teknet7_237497
Icon for Nimbostratus rankNimbostratus
11 years ago

TCP Profile - extremely pushy F5 (RST after 300 us)

Hello Team, I do have VIP with the Pool of two servers and standard profile protocol: TCP. What i have noticed that after TCP SYN packet is routed by F5 to real server F5 is extremely pushy and e...
application delivery
BIG-IP
LTM
Brad_Parker_139's avatar
Brad_Parker_139
Icon for Nacreous rankNacreous
11 years ago

your capture only shows one side of the conversation. If the LTM is resetting the connection you would see syn, syn, syn, before a reset is sent with the profile you provided. Try and capture the conversation on both ingress and egress vlans.

 

  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    11 years ago
    It is definitely not normal for the LTM to send on SYN followed by a RST less than 200ms later. Using tcpdump on the LTM enable max vebose using "tcpdump -s0 -ni (server vlan):nnn host 172.16.34.101 and host 172.16.33.1 -w /tmp/reset.pcap" where (server vlan) is the name of the vlan used to connect to the pool member. The :nnn should give us a RST cause in the RST packet. You can view this in wireshark using the F5 plugin for wireshark. https://devcentral.f5.com/s/articles/getting-started-with-the-f5-wireshark-plugin-on-windows
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    11 years ago
    Also, have you checked the LTM logs for anything that may pop out as a related error?