Forum Discussion

helenio's avatar
helenio
Icon for Nimbostratus rankNimbostratus
Dec 19, 2013

How can I follow a HTTPS connection from a specified client IP

Hello, I have a HTTP virtual server IP in production. Behind that Virtual server there is pool with 3 members. I'd like to troubleshooting connection from my ip client to server to see the entire flow (from client to virtaul server and from ltm to server).

 

I'm intersted to se HTTP messages from client to server. I used tcpdump to capture all traffic directed to virtual server ip and to pool server ips. Afterword I read the file captured with wireshak and tried to filter only my connection.

 

What I'm not able to do is to put in relation the client side connection with the server side connection. I mean client start a connection and BIG-ip proxy it to a server. Ho w can I follow the client connection from client to server since BIG-IP proxy it ?

 

Should insert sesion cookies ? can I do directly on ltm without tcpdump ?

 

TMSH

8 Replies

Sort By
  • Torti's avatar
    Torti
    Icon for Altostratus rankAltostratus
    Dec 19, 2013

    you could insert a header with the client ip via an irule (i.e. x-forwarded-for). this can be done with a http profile automatically, too. Then you have to capture a dump from both sites. With wireshark, you can search for the x-forwarded-for header, now.

     

  • uni_87886's avatar
    uni_87886
    Icon for Cirrostratus rankCirrostratus
    Dec 20, 2013

    The version of tcpdump which comes with the latest versions of the BigIP software (not sure when it appeared, sorry. Certainly 11.4.0) there is an option to follow the associated flow. You need to specify a vlan in the interface, and add 😛 (no, that is not a smiley :P) For example

    tcpdump -v -s0 -w my.cap -i external:p host 10.1.2.3

    There are some other cool flags added to tcpdump too. Check the man page under the -i flag.

    • uni_87886's avatar
      uni_87886
      Icon for Cirrostratus rankCirrostratus
      Dec 20, 2013
      I checked the release notes. The :p flag was introduced in 11.4.0
    • Torti's avatar
      Torti
      Icon for Altostratus rankAltostratus
      Dec 20, 2013
      that sounds like a nice new feature. it's a pity, that we still can't run on 11.4 :-(
  • uni's avatar
    uni
    Icon for Altostratus rankAltostratus
    Dec 20, 2013

    The version of tcpdump which comes with the latest versions of the BigIP software (not sure when it appeared, sorry. Certainly 11.4.0) there is an option to follow the associated flow. You need to specify a vlan in the interface, and add 😛 (no, that is not a smiley :P) For example

    tcpdump -v -s0 -w my.cap -i external:p host 10.1.2.3

    There are some other cool flags added to tcpdump too. Check the man page under the -i flag.

    • uni's avatar
      uni
      Icon for Altostratus rankAltostratus
      Dec 20, 2013
      I checked the release notes. The :p flag was introduced in 11.4.0
    • Torti's avatar
      Torti
      Icon for Altostratus rankAltostratus
      Dec 20, 2013
      that sounds like a nice new feature. it's a pity, that we still can't run on 11.4 :-(