Is there a way to trace connections?

Question

Is there a tool within the Big-IP that allows you to trace inbound connection to see which virtual server its being processed by?

psfletchthetek · Accepted Answer

Hi,
A couple of people have asked very simular questions resently.Try looking hereSolved: iRule to log traffic details - DevCentral (f5.com)
This page shows how to get the virtual server namehttps://community.f5.com/t5/codeshare/example-of-static-variables-with-virtual-server-specific/ta-p/280350You may also find these to links useful for HTTP and IP info for the connection.
https://clouddocs.f5.com/api/irules/HTTP.html
https://clouddocs.f5.com/api/irules/IP.html
From the first example, plus the other references you should be able to pull together you want to see and either log this to file or to a remote server.
&nbsp;
&nbsp;

paulius · Answer

TrainerBob I believe what you're looking for is at the following link.
https://my.f5.com/manage/s/article/K40033505
Once you have this information you should be able to easily tell which virtual server (VS) is being used based on destination IP, port, and protocol.

psfletchthetek · Answer

Not to sure what you are trying to find out here.But you can amend your logging to send logs on a per connection basis and review and filter that using a policy or irule.
Or you could use telemetry or netflow with a suitable collector to filter it down at that level.
Depends on what you are looking for and the tools around you.
The cli option is more real-time but again might tell you want you want to know.

trainerbob · Answer

This might be the solution. Can you explain what the "Slot" number and TMM instance is? Is this related to a virtual server?

The goal I'm trying to get to is to identify which VS is processing a specific connection. This is for troubleshooting purposes.

trainerbob · Answer

Will the logs show which VS is processing a specific connection? I'm not seeing anything for my client IP when I grep /var/log/ltm for it. I'm guessing maybe I need to make a change to the log settings to get connections logged or they're in another log?

Forum Discussion

Is there a way to trace connections?

5 Replies

Recent Discussions

(How) can I get two client certificates in one APM session?

Open Redirection Mitigation

Using okta as SSO to login F5 GUI

snmp automatic stop mail send

BIG-IP DNS iRule issue with static variable

Related Content

Packet Tracing in BIG-IP AFM

iRule Execution Tracing and Performance Profiling, Part 1

iRule Execution Tracing and Performance Profiling, Part 2

Securely connecting Kubernetes Microservices with F5 Distributed Cloud

iRule Execution Tracing and Performance Profiling, Part 3