HTTP 1.1 monitoring in F5

If you need to add a health check to monitor http 1.1 page, then you can use the following steps:

To prevent the monitor from incorrectly marking the server down, modify the health monitor Send String to send an HTTP 1.1 request by specifying the HTTP version, the required Host header, and the Connection: close header. 

Note: HTTP/1.1 requires the Host header to be present in the request but does not require the header to contain a value. If you do not have a specific host name on your server, a value of Host: <space> suffices in most cases. A null value is valid unless the HTTP server requires them for virtual hosting.

For example:

Your existing monitor requests the default document in the root directory by sending the following Send String:

GET /

To send an HTTP 1.1 compliant request, modify the existing Send String to appear similar to one of the following examples, depending on your version:

10.2.0 and later

GET / HTTP/1.1\r\nHost: host.domain.com\r\nConnection: Close\r\n\r\n

or

GET / HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n

9.4.x, 9.6.x, 10.0.x and 10.1.x

GET / HTTP/1.1\r\nHost: host.domain.com\r\nConnection: Close

or

GET / HTTP/1.1\r\nHost: \r\nConnection: Close

9.2.x and 9.3.x

GET / HTTP/1.1\r\nHost: host.domain.com\r\nConnection: Close\r\n

or

GET / HTTP/1.1\r\nHost: \r\nConnection: Close\r\n

9.0.x and 9.1.x

GET / HTTP/1.1\nHost: host.domain.com\nConnection: Close\n

or

GET / HTTP/1.1\nHost: \nConnection: Close\n

4.x

GET / HTTP/1.1\nHost: host.domain.com\nConnection: Close\n

or

GET / HTTP/1.1\nHost: \nConnection: Close\n

Original instruction located at http://support.f5.com/kb/en-us/solutions/public/3000/200/sol3224.html

 

Taking tcp and ssl dump on the F5 load balancer

Taking tcp dump on the F5

tcpdump -vvv -nn -A -i dmz_2001 -s 0 -w tcpdump_filename.dat  host 10.1.1.1 and port 443

Taking the ssl dump and decrypt the data that was just captured from the above tcp dump

ssldump -Aed -nr ./tcpdump_filename.dat -k /config/ssl/ssl.key/ssl-key.key > decrypted_ssldump_filename.txt

-------------------- 

-i specify the interface you want to listen on

host is the ip that the data will be coming from (source ip or client ip)