Forum Discussion

shobi1_329850's avatar
shobi1_329850
Icon for Nimbostratus rankNimbostratus
Aug 08, 2017

How do I view which rule closed a TCP connection?

We are trying to troubleshoot an issue that is very puzzling to us. The symptom...when we fail over to another site of ours with F5 configs fully sync'd with the working size we see TCP resets originating from the F5 itself. This is a VIP for our externally hosted/cloud-based external mail provider (ProofPoint) and when this happens mail to/from outside our company is severely delayed.

 

My question for this forum is is there a log or something somewhere that I can watch that will tell me a rule that his triggered that closes TCP connections? NOTE: This only happens from one of our F5's, when it is running on our the F5 it is now it works fine.

 

application delivery
BIG-IP
iRules

1 Reply

Sort By
  • Ed_Summers's avatar
    Ed_Summers
    Icon for Nimbostratus rankNimbostratus
    Aug 08, 2017

    You've checked all the basic issues such as connectivity (routing, ACLs, etc.) and verified that the resets are indeed originating from the BIG-IP? K9812 reviews some common reasons for resets from BIG-IP.

     

    K13233 describes how to enable logging to /var/log/ltm or inside the TCP RST packet itself. Note the warnings about performance degradation and consider your environment.

     

    K13637 describes how to increase the 'noise level' in a tcpdump from BIG-IP. The 'medium' details includes the reset cause.