TCP dump

=======
TCPDUMP
=======

https://devcentral.f5.com/wiki/advdesignconfig.troubleshootingltmmonitors.ashx

We can use tcpdump to see what response is being sent and received to and from the pool member. We use some specific flags to configure the output:

• -nn - don't attempt to convert IP addresses to hostnames or ports to service names
• -X - print hex and ascii output
• -s0 - don't limit the snap length (packet size) captured

tcpdump -nni 0.0 -X -s0 host 10.x.x.1 and port 80 and host 10.x.x.2 -w test.pcap



To filter the traffic, we use the pool member IP address, port and the non-floating self IP that the monitor requests will be sent from.

===========================================================

To take source , VIP and pools into account

 If
============================

Source : 1.1.1.1 port 1111
VIP: 2.2.2.2
Pool Members: 3.3.3.3 and 4.4.4.4 port 12345

Then
=============================
 tcpdump -nni 0.0:nnn -s0 -C 10 -W 100 --w /var/tmp/tcpdump.pcap  '( host 1.1.1.1 or host 2.2.2.2 and port 1111) or ((host 3.3.3.3 or host 4.4.4.4 ) and port 12345)'  -vvv
  

SNAT features

http://support.f5.com/kb/en-us/solutions/public/7000/800/sol7820.html

GTM good links

http://support.f5.com/kb/en-us/products/big-ip_gtm/manuals/product/gtm-concepts-11-3-0.html

IQUERY good links

support.f5.com/kb/en-us/solutions/public/0000/100/sol159.html

http://support.f5.com/kb/en-us/products/big-ip_gtm/manuals/product/gtm-concepts-11-3-0/2.html

SSL well explined by F5

SSL

Links from F5

https://devcentral.f5.com/articles/ssl-profiles-part-1

Links suggested by F5

http://dimacs.rutgers.edu/Workshops/ComputerSecurity/slides/d4_tls_ssl.pdf
http://www.ietf.org/rfc/rfc2246.txt


SSL external links

http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html

SSL profile explained below by F5

http://support.f5.com/kb/en-us/solutions/public/10000/100/sol10167.html

Troubleshooting BIG-IP GTM synchronization and iQuery connections (11.x)

http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13690.html

GTM listener