Forum Discussion
Muhannad
Cirrus
CirrusTCPDUMP in BigIP for traffic coming from distrbuited cloud.
Dears, I have an internal BigIP WAF receiving the traffic redirected by F5 Distrbuited cloud, when i doing tcpdump, i can see only the traffic sourced from distrbuited cloud IP addresses, this is...
Hello Muhannad​
This is expected behavior
Unfortunately, tcpdump cannot natively use the XFF header as the packet source IP, because XFF is an HTTP header (Layer 7), while tcpdump filters operate on Layer 3 / Layer 4 information.
You could either capture the traffic with tcpdump and then inspect/filter the HTTP headers in Wireshark, or use an iRule to log the information you need.
