For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Aug 28, 2009

tcpdump and Forwarding (IP) Virtual Servers

I can not figure out why tcpdump won't capture TCP packets, but can capture ICMP packets when accessing a node on an internal vlan through a Forwarding (IP) Virtual Server. I have tried both using the...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Aug 28, 2009
For FastL4 VIPs, try running tcpdump on the interface number and not the VLAN name. This is described in SOL6546. The solution suggests disabling acceleration on the VIP, but using the interface number should work as well if the VIP doesn't have heavy load while you're tracing.

 

 

SOL6546: Recommended methods and limitations for running tcpdump on a BIG-IP version system

 

https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html

 

 

Limitations

 

 

The tcpdump utility runs on the Linux Host CPU, which does not receive PVA-accelerated traffic. Therefore, virtual server traffic that is fully accelerated by the PVA chip will not be captured by tcpdump. The PVA chip resides on the switchboard, between the BIG-IP system's switch subsystem and the host motherboard.

 

 

Aaron