Forum Discussion

Nishal_Rai's avatar
Nishal_Rai
Icon for Cirrocumulus rankCirrocumulus
Nov 30, 2023

What does BigIP Internal Module, N/A and Blocked by DoS Layer 7 Enforcer refers to, in HTTPAnalytics

Hello Everyone, I got stumbled upon the terms mentioned below when I exported the pdf from HTTP Analytics BigIP Internal Module N/A Blocked by DoS Layer 7 Enforcer. Is anyone familiar with, wh...
application delivery
security
F5_Design_Engineer's avatar
F5_Design_Engineer
Icon for MVP rankMVP
Nov 30, 2023

Hi  Nishal,

Please refer the following article for the xplanation of all the 62 pramenters 

 

https://my.f5.com/manage/s/article/K34553249

POOLIP IP/Textual Dimension IP of the pool-member that served the transaction. In case that a transaction was replied by the BIG-IP or blocked by BIG-IP before it reached the server, this field will have a textual value telling that and the explaining the which module made the reply, example for possible results:
"BigIP Internal Module"
"Response by RAM CACHE"
Blocked by DoS Layer 7 Enforcer"

 

IsInternalActivity Boolean Dimension

Values can be 0 or 1.
Internal activity means a transaction that was generated by JS that was injected by BIG-IP.
It is useful in differentiating between traffic that the client asked to perform, vs traffic that was generated by BIG-IP own tools.

 

 HTH

🙏

 
  • Nishal_Rai's avatar
    Nishal_Rai
    Icon for Cirrocumulus rankCirrocumulus
    Nov 30, 2023

    Hello,

    Thank you for sharing the resource detailing the HTTP analytics profile for F5 BIG-IP.


    I'm still a bit unclear regarding the distinction between server latency and application response time metrics.

    From my understanding, in the case of the virtual server filter, the server latency metric measures the delay between the real end user and the F5-hosted virtual server IP address—is this accurate?


    Regarding the BIG-IP pool member, I assume the server latency measures the delay between the F5 self-IP address and the destinated actual node (server) —is my understanding correct here?


    The confusion persists similarly with application response time. Could you clarify these distinctions?

    So to consider the actual server latency and application response time, which metrics should I consider, is it the virtual server or the pool member?

    Additionally, I encountered "N/A" while applying the filter and exporting the PDF of the HTTP analytics. It appears to share most metrics with the data mentioned earlier. Could you shed some light on this?