Very Slow Application performance behind F5

Following up on the second round of packet captures - the file Wireshark_173_030910.pcap (taken on the webserver) shows that the difference in the connection response time is due to some unknown issue within the server itself.

 

 

Ephemeral port tcp.port==2271 shows the test session through the LTM to the webserver.

 

Sequence number 1038 is the GET for the login page (only shows 'Application Data' due to encryption).

 

The ACK is sent 0.14 seconds later in sequence number 1042 The application data in response to the GET is sent starting in sequence number 1441 - this is 8.77 seconds after the ACK.

 

The data transfer continues until sequence number 1544, though that whole transfer took about 0.02 seconds.

 

 

So the general focus of the investigation should be at the webserver to see why it is waiting 8.77 seconds before returning that application data.

 

 

Note, we are taking additional captures to see where this delay lies. Note when connecting directly to the same web server there is no delay. It is only through LTM. We are looking at additional captures now to see if we can pin point what is happening. The server should behave the same regardless of if the call comes thru LTM or not I would think. We continue to research and will update.