Forum Discussion
5 Replies
Sort By
- unRuleY_95363Historic F5 AccountWell, the CLIENT_CLOSED or SERVER_CLOSED event will trigger, however, there isn't a command that will return the reason for the close (whether idle_timeout, FIN, or RST). Maybe rapmaster_c knows of something tricky we can do with the existing set of TCP commands...
- rapmaster_c_127Historic F5 AccountSorry, there's no good way right now to catch a connection closing with a RST as opposed to a 4-way close. One thing we've seen quite a bit of on the internet is upstream proxies that seem to tear down all connections with RSTs rather than properly 4-way close. This may be due to a very short (non-existent?) close-wait timeout on their stacks, so a rule event to distinguish between orderly 4-way closes, and RST-driven teardowns might cause a number of false alarms.
- John_Survant_45NimbostratusIt looks like someone was trying to figure this out several years ago. Has F5 been able to find a way to capture TCP Resets in an iRule now? It seems like a rather common question.
- John_Survant_45NimbostratusIt looks like someone was trying to figure this out several years ago. Has F5 been able to find a way to capture TCP Resets in an iRule now? It seems like a rather common question.
- Deb_Allen_18Historic F5 AccountNo, we still don't have any commands specific to TCP flags or IP data.