Forum Discussion

Livius's avatar
Livius
Icon for Altostratus rankAltostratus
Oct 22, 2024

Ways to correlate client side and server side connections

Hi all,

 

Wondering if there are any new methods to correlate client side and server side connections? Say I have the client IP and ephemeral source port is there any feature that allows me to see the end to end conversation ?

I am aware of the tcpdump with verbosity parameters, flow id, but I was wondering if there are any other ways easier that this above.

 

Thanks in advance!

  • if you're talking about active connections, this information is usually stored in the connection table. if you run the: tmsh show sys conn cs-client-addr <client ip> cs-client-port <client port>
    command , you'll be able to see all active connection for the given client address, and the correlated server-side connection. 

    if you want to filter for a specific Virtual Server, you can add the: cs-server-addr <VS ip> cs-server-port <VS port> 
    options, and the output will only match active connections on selected VS for the selected client, one row for each connection. 

    if more details is required, you can also append the "all-properties" option to the command in order to see informations such as input/output throughputs, the configured & residual idle timeouts, or lasthop mac addresses. once again - one entry per active connection.

  • if oneconnect is enabled, there will be multiple client side tcp sessions served by a server side tcp session.

    you can try to add custom http request header containing client's source ip and port addresses so you can search easier in tcpdump.