Forum Discussion
NimbostratusWhy am I seeing Active Connections on my STANDBY LTM-3400?
Hello, I just ssh'd in to my Standby LTM-3400 unit. I am seeing Connections on this device.... shouldn't I only see connections on my main BigIP LTM-3400 bigip1.internal.com ? Do I have a routing issue? Shouldn't the Active Connections be "0" on the Standby Unit? Why is there connections on the Standby Unit?
You will see below that is shows 622 connections on my Standby....
| bits since | bits in prior | current
| Mar 28 18:22:32 | 8 seconds | time
BIG-IP STANDBY |---In----Out---Conn-|---In----Out---Conn-| 10:42:04
bigip2.internal.com 2.374T 4.251T 866.4M 1.741M 3.113M 622
VIRTUAL ip:port |---In----Out---Conn-|---In----Out---Conn-|-Nodes Up--
none:any 1.144M 114560 531 0 0 0 0
Thanks for any help on this.
4 Replies
- nitass
Employee
i do not know why connection is not 0 but you may run tcpdump to see what traffic is.
dump to screen
tcpdump -nni 0.0
write to file
tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap -v 
ChadBigIP_14663I captured the data.
When I try to view it, I get all garbage text....
Is there a way to view it in a clean format?
It looks like there are a lot of ECV Checks going on from what I could see
when I typed:
more output.pcap
Thanks.- nitassmore output.pcap have you tried wireshark?
Bigtop will show all connections moving through TMM. This includes HA traffic between the Active and Standby (network heartbeat, peer ID traffic, connection mirroring, etc.) Also, bigd (health check daemon) forwards it's monitor traffic through TMM and out of the switch fabric so TMM will actively track and report on this stuff.
You can always use this syntax to see all traffic moving through TMM (but be careful on a very busy box):
tcpdump -nni 0.0 -s0 -w /var/tmp/all_TMM_traffic.cap
This command show all "self" traffic, meaning traffic that originates inside the box, like monitor and HA traffic:
tmsh show sys connection type self
