Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Aug 28, 2009

tcpdump and Forwarding (IP) Virtual Servers

I can not figure out why tcpdump won't capture TCP packets, but can capture ICMP packets when accessing a node on an internal vlan through a Forwarding (IP) Virtual Server. I have tried both using the vlan name for the interface (i.e. tcpdump -ni internal1 host x.x.x.x), and 0.0 (i.e. tcpdump -ni 0.0 host x.x.x.x). When I ping I can see the incoming and response packets. However if I telnet to an open port, tcpdump displays nothing.

Anyone know why this is? 

virtual vs_0_0_0_0_any { 
    destination any:any 
    ip forward 
    profile fastl4_vs_0_0_0_0_any 
 } 
  
 profile fastL4 fastl4_vs_0_0_0_0_any { 
    defaults from fastL4 
    idle timeout 7200 
 }
management
monitoring

5 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Aug 28, 2009
    For FastL4 VIPs, try running tcpdump on the interface number and not the VLAN name. This is described in SOL6546. The solution suggests disabling acceleration on the VIP, but using the interface number should work as well if the VIP doesn't have heavy load while you're tracing.

     

     

    SOL6546: Recommended methods and limitations for running tcpdump on a BIG-IP version system

     

    https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html

     

     

    Limitations

     

     

    The tcpdump utility runs on the Linux Host CPU, which does not receive PVA-accelerated traffic. Therefore, virtual server traffic that is fully accelerated by the PVA chip will not be captured by tcpdump. The PVA chip resides on the switchboard, between the BIG-IP system's switch subsystem and the host motherboard.

     

     

    Aaron
  • smp_86112's avatar
    smp_86112
    Icon for Cirrostratus rankCirrostratus
    Aug 28, 2009
    Regarding PVA, it's a little strange: the VIP is using a FastL4 profile where the PVA Acceleration value is set to "Full", but the VIP properties it is displayed as "Assisted". So I'm not sure which value it is.

     

     

    But thank you so much for that SOL reference hoolio. I don't know why I could not find that doc myself. I did use the interface number and was able to get at least some of the packets. That combined with the doc addresses my question.

     

     

    Thanks again. This has been a problem which has bothered me for a loooong time...
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Aug 29, 2009
    A combination of factors determine weather PVA will be honored, regardless of hard codding the setting.

     

     

    Please look at the following documentation regarding PVA

     

     

    https://support.f5.com/kb/en-us/solutions/public/4000/800/sol4832.html

     

     

    I hope this helps

     

    CB