QuestionQ165

Identify and Resolve LTM Device Issues

An application is configured on an LTM device:

  • Virtual server: 10.0.0.1:80 (VLAN vlan301)
  • SNAT IP: 10.0.0.1 -
  • Pool members: 10.0.1.1:8080, 10.0.1.2:8080, 10.0.1.3:8080 (VLAN vlan302)

Which packet capture should the LTM Specialist run from the LTM device command-line interface to capture only this application's server traffic?

  • A tcpdump -ni 0.0:nnn -s 0 'host 10.0.0.1' -w /var/tmp/trace.cap
  • B tcpdump -ni vlan301 -s 0 'port 80 and host 10.0.0.1' -w /var/tmp/trace.cap
  • C tcpdump -ni vlan302 -s 0 'port 8080 and (host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3)' -w /var/tmp/trace.cap
  • D tcpdump -ni 0.0:nnn -s 0 '(port 80 and host 10.0.0.1) or (port 8080 and host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3)' -w /var/tmp/trace.cap
Explanation

Server-side application traffic traverses vlan302 between the LTM and the pool members, using port 8080. A capture restricted to that VLAN, port, and the three pool-member addresses isolates the backend traffic for this application. F5 documents that tcpdump can capture traffic on a specified interface and recommends narrowly scoped filters; its BIG-IP tcpdump guidance also distinguishes client- and server-side traffic.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!