Forum Discussion
smp_86112
Cirrostratus
Cirrostratustcpdump and Forwarding (IP) Virtual Servers
I can not figure out why tcpdump won't capture TCP packets, but can capture ICMP packets when accessing a node on an internal vlan through a Forwarding (IP) Virtual Server. I have tried both using the vlan name for the interface (i.e. tcpdump -ni internal1 host x.x.x.x), and 0.0 (i.e. tcpdump -ni 0.0 host x.x.x.x). When I ping I can see the incoming and response packets. However if I telnet to an open port, tcpdump displays nothing.
Anyone know why this is?
virtual vs_0_0_0_0_any {
destination any:any
ip forward
profile fastl4_vs_0_0_0_0_any
}
profile fastL4 fastl4_vs_0_0_0_0_any {
defaults from fastL4
idle timeout 7200
}- The_Bhattman
Nimbostratus
Do you have ASIC turned on for vs_0_0_0_0?
CB 
hoolioFor FastL4 VIPs, try running tcpdump on the interface number and not the VLAN name. This is described in SOL6546. The solution suggests disabling acceleration on the VIP, but using the interface number should work as well if the VIP doesn't have heavy load while you're tracing.
SOL6546: Recommended methods and limitations for running tcpdump on a BIG-IP version system
https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html
Limitations
The tcpdump utility runs on the Linux Host CPU, which does not receive PVA-accelerated traffic. Therefore, virtual server traffic that is fully accelerated by the PVA chip will not be captured by tcpdump. The PVA chip resides on the switchboard, between the BIG-IP system's switch subsystem and the host motherboard.
Aaron
smp_86112Regarding PVA, it's a little strange: the VIP is using a FastL4 profile where the PVA Acceleration value is set to "Full", but the VIP properties it is displayed as "Assisted". So I'm not sure which value it is.
But thank you so much for that SOL reference hoolio. I don't know why I could not find that doc myself. I did use the interface number and was able to get at least some of the packets. That combined with the doc addresses my question.
Thanks again. This has been a problem which has bothered me for a loooong time...- The_BhattmanA combination of factors determine weather PVA will be honored, regardless of hard codding the setting.
Please look at the following documentation regarding PVA
https://support.f5.com/kb/en-us/solutions/public/4000/800/sol4832.html
I hope this helps
CB - smp_86112That was another really nice reference doc. Thanks CB.
