Forum Discussion
TMcGov_92811
Nimbostratus
Nimbostratustmsh LTM connection table
When hitting a https VS I see two entries in the connection table. Can someone explain why there are 2 entries, one on :443 and one on :0 ???
I am troubleshooting a problem and would like like to know what the ::.0 connections mean and if it is an issue.
tmcgover@ma-npweb-bip3600a(Active)(tmos) show sys connection cs-server-addr 198.204.13.19 Sys::Connections 198.204.15.125:53837 198.204.13.19:443 10.88.186.106:80 tcp 0 198.204.15.125:53836 198.204.13.19:443 ::.0 tcp 1
DETAILS:
tmcgover@ma-npweb-bip3600a(Active)(tmos) show sys connection cs-server-addr 198.204.13.19 all-properties Sys::Connections
198.204.15.125:1609 - 198.204.13.19:443 - ::.0TMM 0 Type any Protocol tcp Idle Time 1 Idle Timeout 300 Unit ID 1 Lasthop QA-Web-Ext-184 00:00:5e:00:01:25 Virtual Path 198.204.13.19:443
ClientSide ServerSide
Client Addr 198.204.15.125:1609 ::.0 Server Addr 198.204.13.19:443 ::.0 Bits In 29.4K 0 Bits Out 38.2K 0 Packets In 15 0 Packets Out 11 0
198.204.15.125:1995 - 198.204.13.19:443 - 10.88.186.106:80TMM 0 Type any Protocol tcp Idle Time 13 Idle Timeout 300 Unit ID 1 Lasthop QA-Web-Ext-184 00:00:5e:00:01:25 Virtual Path 198.204.13.19:443
ClientSide ServerSide
Client Addr 198.204.15.125:1995 198.204.15.125:1996 Server Addr 198.204.13.19:443 10.88.186.106:80 Bits In 15.5K 5.3K Bits Out 6.9K 11.2K Packets In 9 5 Packets Out 5 6
What_Lies_Bene1Cirrostratus
If my memory serves me correctly, the ::.0 entries relate to connections where a load balancing decision has not yet been made, hence ::.0 is listed rather than a pool member IP address.
TMcGov_92811Does this indicate an issue with the LTM performance or configuration ? What can't a load balancing decision be made ? This is occurring during a high volume load test.
- What_Lies_Bene1
Not at all, it's just that at any point in time there will be connections that haven't yet been load balanced. Additionally, there are other reasons such as the TCP 3 way handshake may not have completed client side, an iRule may be processing the connection (sending a redirect for instance), the response may be served from cache (so no need for a server side connection) and so on.
I'm not surprised you are seeing lots of entries like this under high load.
Anthony_Cheng_1I wish there is a in-depth article in DevCentral on this (assuming it hasn't been written) as this command is extremely useful when checking actual load balancing.
Also note there is a bug on this so maybe it was wise not to run this command (at least until 11.6). :) https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15246.html