For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Ho's avatar
Mike_Ho
Icon for Cirrus rankCirrus
Nov 17, 2015

tcpdump - bad capture on BigIP or insane client?

I'm troubleshooting an issue where my users in a certain country cannot access a certain VIP on LTM. In this instance my client-side sees a full 3-way handshake and tries to negotiate SSLv2 (don't s...
BIG-IP
devops
SynACk_128568's avatar
SynACk_128568
Icon for Cirrostratus rankCirrostratus
Nov 17, 2015

have you checked the ltm logs for syncookie activation ? And have you checked the device before the F5 if they are seeing the packets which client is sending .

 

also in the capture you can try seraching with the sequence number tcp.seq == 23

 

Please apply more granular tcpdump filter if possible or you can try on all the vlans may be some routing issue.

 

Thanks