For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jason_40733's avatar
Jason_40733
Icon for Cirrocumulus rankCirrocumulus
Nov 08, 2011

Tracking server side IPs using an external SNAT translation?

We have a fairly straight forward setup on our LTM.     There is an external SNAT address that is generating lots of traffic to an application that is due to be decommissioned. Any servers ...
config
design
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Nov 08, 2011
A few options:

 

 

Create a forwarding VS for the destination host that you want to report on and use a new SNAT address for the traffic. You can then view the VS stats to check for conn rates, tcpdump to trace or an iRule to log client IPs.

 

 

Check the connection table entry to see which client IPs are using the SNAT.

 

 

Use the -i 0.0:nnn in your tcpdump to command to record the flows in the tcpdump:

 

http://devcentral.f5.com/wiki/AdvDesignConfig.F5WiresharkPlugin.ashx

 

 

Aaron