For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

villeneuvej_135's avatar
villeneuvej_135
Icon for Nimbostratus rankNimbostratus
Oct 18, 2013

Why there is "any6" entry in Big-Ip connection table server side

Hi,

 

When I do a "show sys connection" I see any6.any in some of entry in the server side. I don't understand why some entry have it and some don't. I see it with TCP and UDP, I see it when there is only one member and when there is more than one member. For one of our virtual sever, all connections have always any6.any in the server side, why? What exactly trigger the "any6.any" in a connection entry? Ex.: 1.1.1.1%10:2723 2.2.2.2%10:443 any6.any any6.any tcp 11 (tmm: 1) none

 

The only explanation I have found is: sol7758: The BIG-IP connection table command output may contain 'any6' entries

 

The any6 entry in the server section of the table occurs when a client connects to a virtual server, but a load balancing decision has not yet been made.

 

any6
any6.any
management
show sys connection

8 Replies

  • YellowJacket_17's avatar
    YellowJacket_17
    Icon for Nimbostratus rankNimbostratus
    May 04, 2016

    Ditto, seeing the same thing on the server side (not the client side). It hangs around for a few seconds and then falls off. Sounds like maybe an internal F5 thing, guess I won't worry about it.

     

    • Prasad_Chowdary's avatar
      Prasad_Chowdary
      Icon for Nimbostratus rankNimbostratus
      Aug 16, 2016

      I saw the same issue on my config. Did any one able to find the root cause of this issue???

       

  • KDS2014's avatar
    KDS2014
    Icon for Nimbostratus rankNimbostratus
    Nov 17, 2015

    I'm seeing the same issue, anybody able to answer the question why?

     

  • villeneuvej_135's avatar
    villeneuvej_135
    Icon for Nimbostratus rankNimbostratus
    Oct 23, 2013

    Hi,

     

    No we are not using oneconnect. I understand it may contain any6 entries. My question is more: What exactly trigger the "any6.any" in a connection entry (show sys connection) when you don't used oneconnect?

     

    If the answer is: a load balancing decision has not yet been made. Why?

     

    For one particular VServer I always sees connection with any6.any on the server side. I compare with other vserver and they don't have any6.any on any side...

     

    Thanks

     

  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    Oct 19, 2013

    you are using oneconnect, aren't you?

    i understand with oneconnect, serverside is detached after sending response. clientside will be in connection table until it is closed e.g. FIN, idle timeout, etc.

    root@(ve11a)(cfg-sync Changes Pending)(Active)(/Common)(tmos) list ltm virtual bar
ltm virtual bar {
    destination 172.28.20.111:80
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        http { }
        oneconnect { }
        tcp { }
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    vs-index 4
}
root@(ve11a)(cfg-sync Changes Pending)(Active)(/Common)(tmos) list ltm pool foo
ltm pool foo {
    members {
        200.200.200.101:80 {
            address 200.200.200.101
        }
    }
}

 client sends FIN at 10:49:10

[root@ve11a:Active:Changes Pending] config  tcpdump -nni 0.0 host 172.28.20.111
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes
10:48:54.510888 IP 192.168.206.145.56267 > 172.28.20.111.80: S 2766081639:2766081639(0) win 8192 
10:48:54.510937 IP 172.28.20.111.80 > 192.168.206.145.56267: S 985079591:985079591(0) ack 2766081640 win 3780 
10:48:54.513915 IP 192.168.206.145.56267 > 172.28.20.111.80: . ack 1 win 65520
10:48:54.513917 IP 192.168.206.145.56267 > 172.28.20.111.80: P 1:331(330) ack 1 win 65520
10:48:54.514008 IP 172.28.20.111.80 > 192.168.206.145.56267: . ack 331 win 4110
10:48:54.518133 IP 172.28.20.111.80 > 192.168.206.145.56267: P 1:390(389) ack 331 win 4110
10:48:54.559544 IP 192.168.206.145.56268 > 172.28.20.111.80: S 4265805511:4265805511(0) win 8192 
10:48:54.559600 IP 172.28.20.111.80 > 192.168.206.145.56268: S 750733927:750733927(0) ack 4265805512 win 3780 
10:48:54.561520 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 1 win 65520
10:48:54.562507 IP 192.168.206.145.56268 > 172.28.20.111.80: P 1:339(338) ack 1 win 65520
10:48:54.562563 IP 172.28.20.111.80 > 192.168.206.145.56268: . ack 339 win 4118
10:48:54.567574 IP 172.28.20.111.80 > 192.168.206.145.56268: P 1:1461(1460) ack 339 win 4118
10:48:54.567580 IP 172.28.20.111.80 > 192.168.206.145.56268: P 1461:2921(1460) ack 339 win 4118
10:48:54.569502 IP 172.28.20.111.80 > 192.168.206.145.56268: P 2921:4181(1260) ack 339 win 4118
10:48:54.571548 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 2921 win 65520
10:48:54.571585 IP 172.28.20.111.80 > 192.168.206.145.56268: P 4181:4283(102) ack 339 win 4118
10:48:54.573561 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 4283 win 65520
10:48:54.720922 IP 192.168.206.145.56267 > 172.28.20.111.80: . ack 390 win 65131

10:49:10.524597 IP 192.168.206.145.56268 > 172.28.20.111.80: F 339:339(0) ack 4283 win 65520
10:49:10.524781 IP 172.28.20.111.80 > 192.168.206.145.56268: . ack 340 win 4118
10:49:10.524790 IP 172.28.20.111.80 > 192.168.206.145.56268: F 4283:4283(0) ack 340 win 4118
10:49:10.525050 IP 192.168.206.145.56267 > 172.28.20.111.80: F 331:331(0) ack 390 win 65131
10:49:10.525061 IP 172.28.20.111.80 > 192.168.206.145.56267: . ack 332 win 4110
10:49:10.525061 IP 172.28.20.111.80 > 192.168.206.145.56267: F 390:390(0) ack 332 win 4110
10:49:10.527807 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 4284 win 65520
10:49:10.527958 IP 192.168.206.145.56267 > 172.28.20.111.80: . ack 391 win 65131

 clientside entry is deleted at 10:49:11

[root@ve11a:Active:Changes Pending] config  date;tmsh show sys connection cs-server-port 80
Sat Oct 19 10:48:56 SGT 2013
Sys::Connections
192.168.206.145:56268  172.28.20.111:80  any6.any  any6.any  tcp  2  (tmm: 0)  none
192.168.206.145:56267  172.28.20.111:80  any6.any  any6.any  tcp  2  (tmm: 1)  none
Total records returned: 2

[root@ve11a:Active:Changes Pending] config  date;tmsh show sys connection cs-server-port 80
Sat Oct 19 10:49:11 SGT 2013
Sys::Connections
Total records returned: 0
    • hoolio's avatar
      hoolio
      Icon for Cirrostratus rankCirrostratus
      Oct 21, 2013
      Yep. First result for any6 on askf5: SOL7758: The BIG-IP connection table command output may contain 'any6' entries http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7758.html Aaron
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 19, 2013

    you are using oneconnect, aren't you?

    i understand with oneconnect, serverside is detached after sending response. clientside will be in connection table until it is closed e.g. FIN, idle timeout, etc.

    root@(ve11a)(cfg-sync Changes Pending)(Active)(/Common)(tmos) list ltm virtual bar
ltm virtual bar {
    destination 172.28.20.111:80
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        http { }
        oneconnect { }
        tcp { }
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    vs-index 4
}
root@(ve11a)(cfg-sync Changes Pending)(Active)(/Common)(tmos) list ltm pool foo
ltm pool foo {
    members {
        200.200.200.101:80 {
            address 200.200.200.101
        }
    }
}

 client sends FIN at 10:49:10

[root@ve11a:Active:Changes Pending] config  tcpdump -nni 0.0 host 172.28.20.111
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes
10:48:54.510888 IP 192.168.206.145.56267 > 172.28.20.111.80: S 2766081639:2766081639(0) win 8192 
10:48:54.510937 IP 172.28.20.111.80 > 192.168.206.145.56267: S 985079591:985079591(0) ack 2766081640 win 3780 
10:48:54.513915 IP 192.168.206.145.56267 > 172.28.20.111.80: . ack 1 win 65520
10:48:54.513917 IP 192.168.206.145.56267 > 172.28.20.111.80: P 1:331(330) ack 1 win 65520
10:48:54.514008 IP 172.28.20.111.80 > 192.168.206.145.56267: . ack 331 win 4110
10:48:54.518133 IP 172.28.20.111.80 > 192.168.206.145.56267: P 1:390(389) ack 331 win 4110
10:48:54.559544 IP 192.168.206.145.56268 > 172.28.20.111.80: S 4265805511:4265805511(0) win 8192 
10:48:54.559600 IP 172.28.20.111.80 > 192.168.206.145.56268: S 750733927:750733927(0) ack 4265805512 win 3780 
10:48:54.561520 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 1 win 65520
10:48:54.562507 IP 192.168.206.145.56268 > 172.28.20.111.80: P 1:339(338) ack 1 win 65520
10:48:54.562563 IP 172.28.20.111.80 > 192.168.206.145.56268: . ack 339 win 4118
10:48:54.567574 IP 172.28.20.111.80 > 192.168.206.145.56268: P 1:1461(1460) ack 339 win 4118
10:48:54.567580 IP 172.28.20.111.80 > 192.168.206.145.56268: P 1461:2921(1460) ack 339 win 4118
10:48:54.569502 IP 172.28.20.111.80 > 192.168.206.145.56268: P 2921:4181(1260) ack 339 win 4118
10:48:54.571548 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 2921 win 65520
10:48:54.571585 IP 172.28.20.111.80 > 192.168.206.145.56268: P 4181:4283(102) ack 339 win 4118
10:48:54.573561 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 4283 win 65520
10:48:54.720922 IP 192.168.206.145.56267 > 172.28.20.111.80: . ack 390 win 65131

10:49:10.524597 IP 192.168.206.145.56268 > 172.28.20.111.80: F 339:339(0) ack 4283 win 65520
10:49:10.524781 IP 172.28.20.111.80 > 192.168.206.145.56268: . ack 340 win 4118
10:49:10.524790 IP 172.28.20.111.80 > 192.168.206.145.56268: F 4283:4283(0) ack 340 win 4118
10:49:10.525050 IP 192.168.206.145.56267 > 172.28.20.111.80: F 331:331(0) ack 390 win 65131
10:49:10.525061 IP 172.28.20.111.80 > 192.168.206.145.56267: . ack 332 win 4110
10:49:10.525061 IP 172.28.20.111.80 > 192.168.206.145.56267: F 390:390(0) ack 332 win 4110
10:49:10.527807 IP 192.168.206.145.56268 > 172.28.20.111.80: . ack 4284 win 65520
10:49:10.527958 IP 192.168.206.145.56267 > 172.28.20.111.80: . ack 391 win 65131

 clientside entry is deleted at 10:49:11

[root@ve11a:Active:Changes Pending] config  date;tmsh show sys connection cs-server-port 80
Sat Oct 19 10:48:56 SGT 2013
Sys::Connections
192.168.206.145:56268  172.28.20.111:80  any6.any  any6.any  tcp  2  (tmm: 0)  none
192.168.206.145:56267  172.28.20.111:80  any6.any  any6.any  tcp  2  (tmm: 1)  none
Total records returned: 2

[root@ve11a:Active:Changes Pending] config  date;tmsh show sys connection cs-server-port 80
Sat Oct 19 10:49:11 SGT 2013
Sys::Connections
Total records returned: 0
    • hoolio's avatar
      hoolio
      Icon for Cirrostratus rankCirrostratus
      Oct 21, 2013
      Yep. First result for any6 on askf5: SOL7758: The BIG-IP connection table command output may contain 'any6' entries http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7758.html Aaron