For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alkuin_Melvin_1's avatar
Alkuin_Melvin_1
Icon for Nimbostratus rankNimbostratus
Dec 09, 2015

TCPDump for capturing traffing between Virtual Server and Pool Members

Hi guys, glad to have this community to help me.   I want to ask what is the best way to capturing traffic between my servers going to a VS and specific pool members.   For example i have one ...
application delivery
LTM
Amine_Kadimi's avatar
Amine_Kadimi
Icon for MVP rankMVP
Dec 09, 2015

Hi, Considering that F5 is a full proxy then you have two distinct client to server connections:

  1. first is (SRC:172.16.16.100 and DST:172.16.16.1),
  2. second is (SRC:X.X.X.X and DST:10.10.10.11 or 10.10.10.12), src depends on your SNAT configuration, if using automap then it is an F5 self IP.

So your tcpdump needs to have an "OR" to match both connections, you've set up and "AND". Something like:

tcpdump -ni 0.0 (src host 172.16.16.100 and dst host 172.16.16.1) or (dst host 10.10.10.11 or dst host 10.10.10.12)