Forum Discussion

jack_10574's avatar
jack_10574
Icon for Nimbostratus rankNimbostratus
Nov 13, 2017

Tcpdump for tcp packet capture question

Hi all   Recently , I am perform a packet capture with tcpdump at F5 for the application .   Base on the tcpdump , I saw the TCP handshake are completed and then follow with client send s...
application delivery
BIG-IP
LTM
Lee_Sutcliffe's avatar
Lee_Sutcliffe
Icon for Nacreous rankNacreous
Nov 13, 2017

There's nothing wrong with your tcpdump syntax, you have used the 

-n 0.0
switch to listen on all interfaces.

If you right click in Wirehshark on the first SYN and select 'Follow TCP Stream' do you see any TCP FIN messages?

Are you sure traffic is returning via the F5? You can also add a 

-e
switch to list which layer 2 VLAN each packet is seen on.