Difference between some irule

Client Accepted - Fires after a connection entered into the connection table. For TCP, after the handshake completes. (text straight from the link)

 

HTTP Request - Fires after the system fully parses the complete client HTTP request headers (text straight from the link)

 

There is a great diagram in this 101 article by Jason Rahm showing when various events fire.

 

CLIENT_ACCEPTED occurs once per connection to a virtual server. On a TCP connection, CLIENT_ACCEPTED is triggered after the 3-way handshake is completed.

Once a TCP connection is established, one or more HTTP requests may flow over that connection. If the virtual server has an HTTP profile assigned, the HTTP_REQUEST event is triggered every time a new HTTP request is received from the client on the virtual server. So while the CLIENT_ACCEPTED event only occurs once per connection, the HTTP_REQUEST event may occur multiple times per connection, depending on other network influences, such as browser behavior, HTTP version, and keep-alive settings.

For example, here is a simple iRule that writes log messages on both the CLIENT_ACCEPTED and HTTP_REQUEST events:

when CLIENT_ACCEPTED {
   log local0. "3-way handshake completed between client at [IP::client_addr] and virtual server at [IP::local_addr]"
}
when HTTP_REQUEST {
   log local0. "Client request for [HTTP::host][HTTP::uri] received from client at [IP::client_addr] to virtual server at [IP::local_addr]"
}

Here is the log output when connecting to the virtual server and load balancing to a back end Apache server where KeepAlive is set to Off:

tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/ received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/css/global.css received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/js/showCookie.js received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/F5-PNG-Logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/askf5.jpg received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/ihealth.jpg received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/facebook_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/twitter_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/background.gif received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/main.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/dc.jpg received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/linkedin_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/youtube_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101

Notice there is a separate connection for each HTTP_REQUEST because the back end server is not honoring the Connection KeepAlive on the request header. Therefore, after each request, the connection is closed, and the browser must establish a new connection to send the next HTTP request. It takes 13 connections to load all 13 page elements.

Here's the same iRule log output but with KeepAlive set to On on the back end server. Notice that there are multiple connections (as established by the browser) but that multiple HTTP requests flow over each connection. In this case, it takes only 5 connections to load the 13 page elements:

tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/ received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/js/showCookie.js received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/css/global.css received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/F5-PNG-Logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/askf5.jpg received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/main.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/ihealth.jpg received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/background.gif received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : 3-way handshake completed between client at 10.10.2.30 and virtual server at 10.10.2.101
tmm[1523]: Rule /Common/test : Client request for 10.10.2.101/images/dc.jpg received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/twitter_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/facebook_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/linkedin_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101
tmm1[1523]: Rule /Common/test : Client request for 10.10.2.101/images/youtube_logo.png received from client at 10.10.2.30 to virtual server at 10.10.2.101