For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

aj1's avatar
aj1
Icon for Nimbostratus rankNimbostratus
Aug 14, 2015

tmsh show /sys connection cs-client-addr x.x.x.x using iControl REST

Been going through the iControl REST reference and it appears appending 

stats
to the GET request outputs the 
tmsh show ...
of a pool, virtual etc. I've tried the same approach for 
tmsh show /sys connections
, and it outputs the complete table, unformatted. Is there any way this can be formatted into a human-readable format, just like the JSON output of a 
tmsh list ...
command.

I would also like to trim that down (Since this is going to be a high load system) using 

cs-client-addr
(or maybe multiple parameters). I can do this using 
get_active_connection_v2
in iControl SOAP. Is there a way to do the same in REST?

{
    "apiRawValues": {
        "apiAnonymous": "Sys::Connections\n10.0.0.3:37843  10.0.0.2:179  10.0.0.3:37843  10.0.0.2:179  tcp  5  (slot/tmm: 1/0)  none\n10.0.1.3:57092    10.0.1.2:179    10.0.1.3:57092    10.0.1.2:179    tcp  6  (slot/tmm: 1/3)  none\n10.0.2.5:37506  10.0.2.4:179  10.0.2.5:37506  10.0.2.4:179  tcp  9  (slot/tmm: 1/1)  none\n10.0.3.3:48427  10.0.3.2:179  10.0.3.3:48427  10.0.3.2:179  tcp  5  (slot/tmm: 1/0)  none\n10.0.4.5:56145    10.0.4.32:53      10.0.4.5:56145    10.0.4.32:53      udp  0  (slot/tmm: 1/0)  none\nTotal records returned: 6\n"
    }, 
    "kind": "tm:sys:connection:connectionstats", 
    "selfLink": "https://localhost/mgmt/tm/sys/connection/stats?ver=11.6.0"
}

Thanks in advance!

application delivery
devops
iControl
iControlREST
LTM
TMOS
TMSH

10 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Aug 26, 2015

    Try this:

    curl -sk -u 'admin:admin' -H "Content-Type: application/json" -X GET "https://x.x.x.x/mgmt/tm/sys/connection?options=ss-client-addr+192.168.6.100&ss-clint-port+33761" |perl -pe 's/\\n/,\n/g'
  • aj1's avatar
    aj1
    Icon for Nimbostratus rankNimbostratus
    Sep 10, 2015

    Thank you Kevin. That worked like a charm. What would be the best way to parse the response table in 

    apiAnonymous
    to display the inside address for the outside address sent in the request (that is 
    cs-server-addr
    ). In the below output, I'd like to get the inside IP 
    172.25.52.251%4
    .

    $ curl -sk -u "admin:admin" -H "Content-Type: application/json" -X GET "https://x.x.x.x/mgmt/tm/sys/connection?options=ss-client-addr+197.72.208.78" | perl -pe 's/\\n/,\n/g'
{"kind":"tm:sys:connection:connectionstats","selfLink":"https://localhost/mgmt/tm/sys/connection?options=ss-client-addr+197.72.208.78&ver=11.6.0","apiRawValues":{"apiAnonymous":"Sys::Connections,
172.25.52.251%4:41334  69.28.57.177%4:10086  197.72.208.78:1142  69.28.57.177:10086  tcp  499  (slot/tmm: 1/0)  none,
172.25.52.251%4:60179  193.235.206.82%4:4070  197.72.208.78:1043  193.235.206.82:4070  tcp  47  (slot/tmm: 1/0)  none,
Total records returned: 2,
"}}
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 10, 2015

    Okay, so you're output should look like this, yes?

    {"kind":"tm:sys:connection:connectionstats","selfLink":"https://localhost/mgmt/tm/sys/connection?options=ss-client-addr+197.72.208.78&ver=11.6.0","apiRawValues":{"apiAnonymous":"Sys::Connections,
172.25.52.251%4:41334  69.28.57.177%4:10086  197.72.208.78:1142  69.28.57.177:10086  tcp  499  (slot/tmm: 1/0)  none,
172.25.52.251%4:60179  193.235.206.82%4:4070  197.72.208.78:1043  193.235.206.82:4070  tcp  47  (slot/tmm: 1/0)  none,
Total records returned: 2,
"}}

    If so, are you just looking for the first address?

  • aj1's avatar
    aj1
    Icon for Nimbostratus rankNimbostratus
    Sep 10, 2015

    Yes Kevin, that is what my o/p looks like. Just want it to be cleaner at this point, by extracting the first address and displaying only that. I'm using python and the 

    requests
    lib for GET(ting) the data, and currently, I can see a fraction of the connection table for that outside ip (
    cs-server-addr
    ). Thanks.

    >>> import requests 
>>> print connTable['apiRawValues']['apiAnonymous']
Sys::Connections
172.25.52.251%4:41334  69.28.57.177%4:10086  197.72.208.78:1142  69.28.57.177:10086  tcp  499  (slot/tmm: 1/0)  none
172.25.52.251%4:60179  193.235.206.82%4:4070  197.72.208.78:1043  193.235.206.82:4070  tcp  47  (slot/tmm: 1/0)  none
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 10, 2015

    One option?

    import re

for line in open("test.txt", "r"):
    if re.search(r'^[^a-zA-Z].*', line) is not None:
        ip = line.split(" ")
        print ip[0]
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 10, 2015

    Haven't tried it, but

    import re

for line in connTable['apiRawValues']['apiAnonymous']:
    if re.search(r'^[^a-zA-Z].*', line) is not None:
        ip = line.split(" ")
        print ip[0]
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 10, 2015

    Okay, for the sake of testing I just rebuilt the whole thing:

    import re
import subprocess

p1 = subprocess.Popen([
        'curl',
        '-sk',
        '-u',
        'admin:admin',
        '-H','Content-Type: application/json',
        '-H','Accept: application/json',
        '-X','GET',
        'https://x.x.x.x/mgmt/tm/sys/connection'
],stdout=subprocess.PIPE)


p2 = subprocess.Popen([
        'perl',
        '-pe',
        '\'s/\\n/,\n/g\''
],stdin=p1.stdout,stdout=subprocess.PIPE)


result = str(p2.communicate()).split('\\n')

for line in result:
        if re.search('^[0-9].*', line) is not None:
                ip = line.split(" ")
                print ip[0]
  • aj1's avatar
    aj1
    Icon for Nimbostratus rankNimbostratus
    Sep 11, 2015

    Works now! Turns out I was missing 

    connTable.split('\n')
    🙂 Thank you for the detailed example above, interesting way of approaching it using 
    subprocess
    .

  • aj1's avatar
    aj1
    Icon for Nimbostratus rankNimbostratus
    Sep 14, 2015

    Hi Kevin. Apologies, should have tested this first time around, but it appears specifying the 

    ss-client-port+33761
    option doesn't trim down the table any further, and instead gives all connection table entries based of 
    ss-client-addr+192.168.6.100
    . I can see only one entry on the BIG-IP (expected), but multiple when the same options are specified in GET.

     show sys connection ss-client-addr 197.72.206.124 ss-client-port 1199
Sys::Connections
172.25.24.86%4:49327  68.67.176.52%4:443  197.72.206.124:1199  68.67.176.52:443  tcp  578  (slot/tmm: 1/1)  none
Total records returned: 1

$ curl -sk -u 'admin:admin' -H "Content-Type: application/json" -X GET "https://x.x.x.x/mgmt/tm/sys/connection?options=ss-client-addr+197.72.206.124&ss-client-port+1199"
{
  "kind": "tm:sys:connection:connectionstats",
  "selfLink": "https://localhost/mgmt/tm/sys/connection?options=ss-client-addr+198.82.208.128&ver=11.6.0",
  "apiRawValues": {
    "apiAnonymous": "Sys::Connections\n172.25.24.86%4:49435  54.243.90.245%4:443  197.72.206.124:1051  54.243.90.245:443  tcp  35  (slot/tmm: 1/1)  none\n172.25.24.86%4:49327  68.67.176.52%4:443  197.72.206.124:1199  68.67.176.52:443  tcp  582  (slot/tmm: 1/1)  none\n172.25.24.86%4:49412  17.143.160.159%4:5223  197.72.206.124:1028  17.143.160.159:5223  tcp  402  (slot/tmm: 1/1)  none\nTotal records returned: 3\n"
  }
}