tcpdump not showing all data

Do you see 'x packets dropped' when running the tcpdump command? If so, you could try to narrow down which packets you're trying to capture using more exact filters.

 

 

Or are you using a FastL4 profile? If so, the packets accelerated by the PVA would not be fully seen by TMM or tcpdump:

 

 

 

https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html

 

 

The tcpdump utility runs on the Linux Host CPU, which does not receive PVA-accelerated traffic. Therefore, virtual server traffic that is fully accelerated by the PVA chip will not be captured by tcpdump. The PVA chip resides on the switchboard, between the BIG-IP system's switch subsystem and the host motherboard.

 

 

The PVA handles accelerated traffic in the following order:

 

 

* The PVA receives accelerated traffic from the switch subsystem

 

* The PVA transforms the packet in order to redirect the packet to the appropriate pool member

 

* The PVA sends the packet back to the switch subsystem

 

 

Fully accelerated traffic never reaches the internal trunk and is not processed by TMM.

 

-------------

 

 

Running tcpdump on a switch interface is rate-limited to 200 packets per second. Therefore, if you run tcpdump on an interface that is processing more than 200 packets per second, the captured tcpdump file will not include all of the packets.

 

 

 

 

Aaron