For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

am_gli_287451's avatar
am_gli_287451
Icon for Nimbostratus rankNimbostratus
Jul 27, 2018

tcpdump flooded with failover packets

Hi, I often have a problem with tcpdump on clustered devices. If I e.g. start a dump like this: 'tcpdump -ni 0.0:p host 192.168.1.1' the terminal is flooded with messages like these eve...
application delivery
LTM
TMOS
crodriguez's avatar
crodriguez
Ret. Employee
Jul 27, 2018

You are not doing anything wrong with your TCPDUMP; you're just capturing more data than you need to. Those packets you're seeing are the network failover "heartbeat" transmitted between devices in a sync-failover device group. If you would rather not see this traffic, then filter out UDP port 1026 on your TCPDUMP command. Or, better yet, filter for the protocol and ports you do want to see.

 

  • Amresh008's avatar
    Amresh008
    Icon for Nimbostratus rankNimbostratus
    Jan 13, 2020

    I get similar response even after limiting the traffic capture to port 1026.