For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SivaYenduri's avatar
SivaYenduri
Icon for Cirrus rankCirrus
Feb 28, 2020
Solved

Troubleshooting traffic spike on loadbalancer

Hello All,   Can someone help me how can i troubleshoot this issue?   Customers are accessing a VIP:8080 and there are around 2k connections on the VIP. But at 10:00AM CET everyday, connecti...
application delivery
BIG-IP
LTM
  • rafaelbn's avatar
    rafaelbn
    Feb 28, 2020

    Hello Siva!

    Do you happen to know the source IP of all those connections?

    I would start by looking at the connection table during that spike. Something like this...

    tmsh show sys connection cs-server-addr <VIP> cs-server-port 8080

    If everything comes from the same IP it could possibly narrow your tshoot down to a specific client.

    Best of luck!

rafaelbn's avatar
rafaelbn
Icon for Cirrostratus rankCirrostratus
Feb 28, 2020

Hello Siva!

Do you happen to know the source IP of all those connections?

I would start by looking at the connection table during that spike. Something like this...

tmsh show sys connection cs-server-addr <VIP> cs-server-port 8080

If everything comes from the same IP it could possibly narrow your tshoot down to a specific client.

Best of luck!

SivaYenduri's avatar
SivaYenduri
Icon for Cirrus rankCirrus
Mar 01, 2020

Thank you for the reply. Unfortunately source is entire corp network.. But this command is helpful.