For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Ho's avatar
Mike_Ho
Icon for Cirrus rankCirrus
Nov 17, 2015

tcpdump - bad capture on BigIP or insane client?

I'm troubleshooting an issue where my users in a certain country cannot access a certain VIP on LTM. In this instance my client-side sees a full 3-way handshake and tries to negotiate SSLv2 (don't s...
BIG-IP
devops
Mike_Ho's avatar
Mike_Ho
Icon for Cirrus rankCirrus
Nov 17, 2015

Here's an HTTP connection attempt between the same client and VIP whereas in the OP it was HTTPS. In this instance notice how the TCP ISN sent by the BigIP (as recorded by tcpdump) does not match the ISN received by the client (as recorded by tcpdump). On retransmitted SYN/ACK packets however the ISN matches on both ends. I'm scratching my head on this. Not all but most HTTP (TCP/80) connection attempts result in this behavior.

 

BigIP sees:

 

Client sees: