Running Wireshark captures from F5 BIG-IP
My colleague, Simon Kowallik, recently posted something really cool to our internal message boards. It started with the question:
“Have you ever wanted to run captures with Wireshark on BIG-I...
Updated Aug 02, 2024
Version 3.0
While the buffering option (-U, for the curious) that David mentions as not being supported by F5’s supplied version of libpcap, the -l flag (line buffering) certainly seems to be. This seems to show all but the last line captured, so the output is a little more immediate. YMMV, of course, but this was tested in 11.4.0 and 11.4.1.