Forum Discussion
NimbostratusTCP RST logs
The TCP RST logs from one of the VIP is not logged/seen. show /net rst-cause is enabled and it shows huge number of RSTs (maybe because they have not been cleared even once). The logs for some of the VIPs configured can be seen but the one which I am concerned is not seen or logged. User has shared logs from his ends which shows intermittent RSTs coming from the F5 VIP. It's for ldap (port 636 - performance Layer4). Running wireshark for uncertain duration is not an option.I know, it could also be because of any remote host (TCP RST from remote system ) but it should be visible.
1 Reply
- Anthony_Graber
Employee
I know you mentioned not running wireshark for an uncertain duration but you could run a tcpdump capture on the BIG-IP to look for resets and reset causes related to port 636. https://support.f5.com/csp/article/K13223 https://support.f5.com/csp/article/K13637
Maybe something like... tcpdump -nni 0.0:nn -v 'tcp[tcpflags] & (tcp-rst) != 0' and port 636 -w /var/tmp/resets.pcap
