tcp perl server health monitor

yeah sorry that was a miss type on my end on this forum port 1000 these are not the actual info I am entering on my F5 but same concept

OK. So, last effort! I'd suggest you run a tpcdump at the same time you do a manual telnet and then one when you run the monitor and try and compare the differences.

 

Manual telnet test Works

 

14:38:12.726321 IP 2.2.2.1.48507 > 1.1.1.1.1000: S 1857348896:1857348896(0) win 14600

 

14:38:12.726514 IP 1.1.1.1.1000 > 2.2.2.1.48507: S 31276580:31276580(0) ack 1857348897 win 14480

 

14:38:12.727009 IP 2.2.2.1.48507 > 1.1.1.1.1000: . ack 1 win 115

 

14:38:20.570661 IP 2.2.2.1.48507 > 1.1.1.1.1000: P 1:6(5) ack 1 win 115

 

14:38:20.570846 IP 1.1.1.1.1000 > 2.2.2.1.48507: . ack 6 win 114

 

said=57096664314:38:35.769612 IP 2.2.2.1.48507 > 1.1.1.1.1000: P 6:22(16) ack 1 win 115

 

14:38:35.769803 IP 1.1.1.1.1000 > 2.2.2.1.48507: . ack 22 win 114

 

14:38:45.201787 IP 2.2.2.1.48507 > 1.1.1.1.1000: P 22:56(34) ack 1 win 115

 

14:38:45.201978 IP 1.1.1.1.1000 > 2.2.2.1.48507: . ack 56 win 114

 

14:38:48.073604 IP 2.2.2.1.48507 > 1.1.1.1.1000: P 56:58(2) ack 1 win 115

 

14:38:48.073789 IP 1.1.1.1.1000 > 2.2.2.1.48507: . ack 58 win 114

 

14:38:48.221189 IP 1.1.1.1.1000 > 2.2.2.1.48507: P 1:59(58) ack 58 win 114

 

14:38:48.221342 IP 1.1.1.1.1000 > 2.2.2.1.48507: F 59:59(0) ack 58 win 114

 

14:38:48.221971 IP 2.2.2.1.48507 > 1.1.1.1.1000: . ack 59 win 115

 

14:38:48.222182 IP 2.2.2.1.48507 > 1.1.1.1.1000: F 58:58(0) ack 60 win 115

 

14:38:48.222256 IP 1.1.1.1.1000 > 2.2.2.1.48507: . ack 59 win 114

 

 

 

 

 

Copying send string data from F5 and adding section by section

 

 

14:40:57.315051 IP 2.2.2.1.30789 > 1.1.1.1.1000: S 1767263785:1767263785(0) win 14600

 

14:40:57.315234 IP 1.1.1.1.1000 > 2.2.2.1.30789: S 3112012472:3112012472(0) ack 1767263786 win 14480

 

14:40:57.316016 IP 2.2.2.1.30789 > 1.1.1.1.1000: . ack 1 win 115

 

14:41:06.136716 IP 2.2.2.1.30789 > 1.1.1.1.1000: P 1:10(9) ack 1 win 115

 

14:41:06.136898 IP 1.1.1.1.1000 > 2.2.2.1.30789: . ack 10 win 114

 

14:41:18.535811 IP 2.2.2.1.30789 > 1.1.1.1.1000: P 10:30(20) ack 1 win 115

 

14:41:18.535998 IP 1.1.1.1.1000 > 2.2.2.1.30789: . ack 30 win 114

 

14:41:26.692803 IP 2.2.2.1.30789 > 1.1.1.1.1000: P 30:32(2) ack 1 win 115

 

14:41:26.692985 IP 1.1.1.1.1000 > 2.2.2.1.30789: . ack 32 win 114

 

14:41:26.693166 IP 1.1.1.1.1000 > 2.2.2.1.30789: P 1:22(21) ack 32 win 114

 

14:41:26.693287 IP 1.1.1.1.1000 > 2.2.2.1.30789: F 22:22(0) ack 32 win 114

 

14:41:26.693998 IP 2.2.2.1.30789 > 1.1.1.1.1000: . ack 22 win 115

 

14:41:26.694192 IP 2.2.2.1.30789 > 1.1.1.1.1000: F 32:32(0) ack 23 win 115

 

14:41:26.694262 IP 1.1.1.1.1000 > 2.2.2.1.30789: . ack 33 win 114

 

 

 

 

 

Using the whole line of send string with telnet test.

 

 

14:51:00.254221 IP2.2.2.1.54271 > 1.1.1.1.1000: S 281417184:281417184(0) win 14600

 

14:51:00.254409 IP 1.1.1.1.1000 >2.2.2.1.54271: S 4255889693:4255889693(0) ack 281417185 win 14480

 

14:51:00.255035 IP2.2.2.1.54271 > 1.1.1.1.1000: . ack 1 win 115

 

14:51:14.159681 IP2.2.2.1.54271 > 1.1.1.1.1000: P 1:64(63) ack 1 win 115

 

14:51:14.159865 IP 1.1.1.1.1000 >2.2.2.1.54271: . ack 64 win 114

 

14:51:16.719690 IP2.2.2.1.54271 > 1.1.1.1.1000: P 64:66(2) ack 1 win 115

 

14:51:16.719876 IP 1.1.1.1.1000 >2.2.2.1.54271: . ack 66 win 114

 

14:51:16.720000 IP 1.1.1.1.1000 >2.2.2.1.54271: P 1:22(21) ack 66 win 114

 

14:51:16.720065 IP 1.1.1.1.1000 >2.2.2.1.54271: F 22:22(0) ack 66 win 114

 

14:51:16.720982 IP2.2.2.1.54271 > 10.24.3.236.1000: . ack 22 win 115

 

14:51:16.721164 IP2.2.2.1.54271 > 1.1.1.1.1000: F 66:66(0) ack 23 win 115

 

14:51:16.721286 IP 1.1.1.1.1000 >2.2.2.1.54271: . ack 67 win 114

 

Sorry, can you use the -s0 and -X flags to display the actual full packet content please.

Hmmm, it's hard to interpret this to be honest. Can I advise you save this to a file and analyse it in Wireshark or something similar. In the third test you seem to be sending a \r\r first?

 

 

You should also capture the actual monitor at work. Interesting to note the %'s in the telnet test don't appear in the other two, perhaps this is a clue? I'm happy to look at the captures if you're happy to upload them but I can understand why you wouldn't want to.

Hi I was able to resolve the issue using tcpdump and creating a workable file for wireshark. I caputred traffic on the interface were I have this health monitor running I imported the file to wireshark and right clicked and selected follow tcp stream and I saw the health monitor making calls to my servers and getting a return response but it was after the health monitor was making 4 calls to server and getting response "example below". So what I did is add \r\n\r\n to end of my send string and this fixed the issue syntax "a=1\r\nid=1234456\r\nfirstname= bob\r\n\r\n" Thank you for your help and advice to use wireshark

 

 

 

 

a=1

 

id=1234456

 

firstname= bob

 

a=1

 

id=1234456

 

firstname= bob

 

a=1

 

id=1234456

 

firstname= bob

 

a=1

 

id=1234456

 

firstname= bob

 

 

lastname=train

You're welcome. Thanks for letting us know. Glad it's sorted.