Forum Discussion

kridsana_52318's avatar
kridsana_52318
Icon for Nimbostratus rankNimbostratus
Feb 10, 2016

F5 send RST for close monitor traffic instead of FIN

Hi

 

Just like Subject. Is this normally?

 

Did F5 have issue about send RST instead of FIN to close monitor connection after receive Response?

 

Thanks in advance

 

1 Reply

  • Hi kridsana,

     

    depending on the selected monitor type, this may be an expected behavior...

     

    "BIG-IP health monitors

     

    Certain BIG-IP monitors may use a TCP RST packet to close the monitor connection when the remote service returns a prompt. For example, the tcp monitor initiates a TCP connection to the remote service. If the service returns a prompt after the connection is established (for example, FTP or SSH), the tcp monitor considers the service to be up, and sends a TCP RST packet to the service.

     

    The following BIG-IP monitor types may use a TCP RST packet to close the monitor connection quickly after receiving matched content:

     

    • The tcp_half_open monitor performs a simple check on the pool member service by sending a TCP SYN packet to the service port. When the monitor receives the SYN-ACK packet from the pool member, the monitor considers the service to be up, and sends a TCP RST packet to the service instead of completing the three-way handshake. The TCP RST packet is typically sent on the server side of the connection, and the source IP address of the reset is the relevant self IP address of the VLAN.

       

    • The HTTP monitor may send TCP reset packets to close the monitor connection as soon as the health check receive string is matched, even if the BIG-IP system has not yet received the entire object that was requested in the HTTP monitor send string. Closing the monitor connection in this way saves BIG-IP system resources."

       

    https://support.f5.com/kb/en-us/solutions/public/9000/800/sol9812.html

     

    Cheers, Kai