Forum Discussion

Nimbostratus

Apr 23, 2014

Solved

Display LTM connections??

I am very new to F5 Big IP, mainly worked with Cisco CSMs and Citrix NetScaler load balancers in the past.....what I am trying to find is how to display what hosts are connected to a particular virtual server, what pool member it's getting routed to and what SNAT address the source is being assigned, etc.

WHat I have is a pair of F5 Big IP 4200s set up in a HA configuration.

Thanks for any help...Jeff

application delivery

LTM

management

smp_86112
Apr 23, 2014
You didn't specify a version, but assuming you're running 10 or 11-something, Yoni is right.
tmsh show sys connection
is the basic starting point, but if that's all you specify, you'll see all the connections - which is probably much more output than you want. You need to specify additional information about the endpoints you care about if you want to limit the output. I think of them as filters in a sense - they limit the output to only things that match. The ones I primarily use are:

cs-client-addr - the (client) source IP address on the clientside of the connection

cs-client-port - the (client) source port on the clientside of the connection

cs-server-addr - the (server) destination IP address on the clientside of the connection (i.e. the Virtual Server IP address)

cs-server-port - the (server) destination port on the clientside of the connection (i.e. the Virtual Server port)

ss-client-addr - the (client) source IP address on the serverside of the connection (i.e. the SNAT address)

ss-client-port - the (client) source port on the serverside of the connection (i.e. the SNAT port)

ss-server-addr - the (server) destination IP address on the serverside of the connection (i.e., the Pool Member address)

ss-server-port - the (server) destination port on the serverside of the connection (i.e., the Pool Member port)

You can mix/match these options as necessary to isolate the connections you are interested in. The more pieces of information you specify, the narrower your focus will be, and the smaller your output will become. So for example, this command would show me all connections from client 100.1.1.1, to any Virtual Server assigned address 10.1.1.0, that were load-balanced to Pool Member 192.168.1.1:9999:
tmsh show sys conn cs-client-addr 100.1.1.1 cs-server-addr 10.1.1.0 ss-server-addr 192.168.1.1 ss-server-port 9999

I have noticed over multiple TMM releases that the ss-client-addr and ss-client-port do not work, despite being available according to the command help. That was frustrating, since quite often these connection points are very important. However I just confirmed they do work in 11.2.1HF10. So depending on what version you're running, you may not see the SNAT address in the output. I think you can also append the all-properties option which should include that output, like this. Unfortunately, the output is not formatted as nicely:
tmsh show sys conn cs-client-addr 100.1.1.1 cs-server-addr 10.1.1.0 ss-server-addr 192.168.1.1 ss-server-port 9999 all-properties

Understanding exactly which points in the connection flow correspond to the cs-client-addr, ss-server-port, etc... options can be very, very helpful in isolating connections in the connection table.

16 Replies

yoni_100721
Nimbostratus
Apr 23, 2014
tmsh show sys connection all-properties

you can filter with options do a "tmsh show sys connection ?" and see
smp_86112
Cirrostratus
Apr 23, 2014
You didn't specify a version, but assuming you're running 10 or 11-something, Yoni is right.
tmsh show sys connection
is the basic starting point, but if that's all you specify, you'll see all the connections - which is probably much more output than you want. You need to specify additional information about the endpoints you care about if you want to limit the output. I think of them as filters in a sense - they limit the output to only things that match. The ones I primarily use are:

cs-client-addr - the (client) source IP address on the clientside of the connection

cs-client-port - the (client) source port on the clientside of the connection

cs-server-addr - the (server) destination IP address on the clientside of the connection (i.e. the Virtual Server IP address)

cs-server-port - the (server) destination port on the clientside of the connection (i.e. the Virtual Server port)

ss-client-addr - the (client) source IP address on the serverside of the connection (i.e. the SNAT address)

ss-client-port - the (client) source port on the serverside of the connection (i.e. the SNAT port)

ss-server-addr - the (server) destination IP address on the serverside of the connection (i.e., the Pool Member address)

ss-server-port - the (server) destination port on the serverside of the connection (i.e., the Pool Member port)

You can mix/match these options as necessary to isolate the connections you are interested in. The more pieces of information you specify, the narrower your focus will be, and the smaller your output will become. So for example, this command would show me all connections from client 100.1.1.1, to any Virtual Server assigned address 10.1.1.0, that were load-balanced to Pool Member 192.168.1.1:9999:
tmsh show sys conn cs-client-addr 100.1.1.1 cs-server-addr 10.1.1.0 ss-server-addr 192.168.1.1 ss-server-port 9999

I have noticed over multiple TMM releases that the ss-client-addr and ss-client-port do not work, despite being available according to the command help. That was frustrating, since quite often these connection points are very important. However I just confirmed they do work in 11.2.1HF10. So depending on what version you're running, you may not see the SNAT address in the output. I think you can also append the all-properties option which should include that output, like this. Unfortunately, the output is not formatted as nicely:
tmsh show sys conn cs-client-addr 100.1.1.1 cs-server-addr 10.1.1.0 ss-server-addr 192.168.1.1 ss-server-port 9999 all-properties

Understanding exactly which points in the connection flow correspond to the cs-client-addr, ss-server-port, etc... options can be very, very helpful in isolating connections in the connection table.
- Tom_9252
  Nimbostratus
  Jan 08, 2016
  Very helpful - thanks!
JRichter_151775
Nimbostratus
May 27, 2014
Sorry for the delayed response....but THANK YOU for the replies.
Neeraj_Jags_152
Cirrus
Jul 09, 2014
Hi,

When I execute the command show /sys connection all-properties I get very huge output but I want to filter it for specific so if I enter the command show /sys connection all-properties | grep -i

then it does not show all the values of connection like idle time out etc.. any guess how to do that ?

I have 11.4 & 11.2 both version.
- smp_86112
  Cirrostratus
  Jul 09, 2014
  I described the filtering mechanism rather completely above. To display the idle time and other properties of a connection, append the "all-properties" argument to the command. To display the available arguments, execute the command `tmsh show /sys connection ?`
Neeraj_Jags_152
Cirrus
Jul 10, 2014
Yes,

I tried the command and verifies the command it working for me only one thing was that. I was using the route domain thats why it was not working and while troubleshooting I got to know that I have to use route domain as % like below. show sys connection cs-client-addr 1.1.2.3%1701 all-properties the above work perfects.

as well as below also show /sys connection cs-client-addr 1.1.2.3%1701 all-properties

Neeraj Jagetia
KDS2014
Nimbostratus
Sep 04, 2015
I like this post.....this has helped me out.
Yamazaki_Hi_257
Nimbostratus
Apr 04, 2016
Do you Have Command to check while Some Session is Lost ? How Can I know ? What Session is lost ?
sahrrr_261578
Nimbostratus
Apr 28, 2016
If we have a lot of current connections, is there a way to execute that command into a log file for viewing?
- tatmotiv
  Cirrostratus
  Apr 29, 2016
  As with all Commands executed in Linux shell, you can redirect the output into a file, e.g. like this (execute in bash, not in tmsh!): bash tmsh show sys connection > /var/tmp/myconnectiondump.txt If you want to generate the file not on the BigIP, but directly on the remote machine on which you are running your ssh client to the BigIp, you could also spawn the ssh session like this: ssh -l | tee someoutputfile.txt That will write all the output of your SSH session into a file for later reference. putty on windows has a similar function somewhere. HTH, Martin
- tatmotiv
  Cirrostratus
  Apr 29, 2016
  dammit, devcentral alway messes up all the formatting in the comments. I'll copy my comment to a separate answer in order to improve readability.
tatmotiv
Cirrostratus
Apr 29, 2016
sahrrr,

as with all commands executed in Linux shell, you can redirect the output into a file, e.g. like this (execute in bash, not in tmsh!):

bash tmsh show sys connection > /var/tmp/myconnectiondump.txt

If you want to generate the file not on the BigIP, but directly on the remote machine on which you are running your ssh client to the BigIp, you could also spawn the ssh session like this nad then run the appropriate tmsh command in that session:

ssh -l | tee someoutputfile.txt

That will write all the output of your SSH session into a file for later reference. putty on windows has a similar function somewhere.

HTH, Martin
IRONMAN
Cirrostratus
Oct 08, 2016
CMD: tmsh show sys connection cs-server-addr 'VIP IP'

Output line:

client ip 2:60745 VIP IP:8090 ::.0 tcp 3

client ip 2:67546 VIP IP:8090 SS Server node:8090 tcp 3

in line one output i am getting server side as ::0 , second line i am getting server side ip with port number'

what is mean by first line output ?