# Module 7: find the last packet. Then name the root cause. Source: https://ai.techclick.in/blog_f5_ltm_troubleshooting_tcpdump_ssl Markdown: https://ai.techclick.in/blog_f5_ltm_troubleshooting_tcpdump_ssl.md Publisher: Techclick Infosec Pvt Ltd F5 BIG-IP LTM Module 7: convert tickets into packet facts, find the last known-good hop, and prove client-side vs server-side TCP, TLS, pool, SNAT, and HA with tcpdump and tmsh. ## This lesson is your Module 7 PDF — interactive Source file: F5-BIG-IP-LTM-Module-7.pdf (22 slides, Downloads). The posters below are the same Techclick infographics from that deck, not generic stock art. Walk the PDF in order: mindset → intake → last known-good hop → packet proof. Module 7 PDF · cover (slide 1) PDF path: CLIENT → DNS/VIP → VIRTUAL SERVER → POOL/BACKEND → RESPONSE. Check every hop with evidence. Module 7 PDF · slide 2 · mindset PDF rule: do not start by changing configuration. Assumption “F5 is dropping traffic” becomes the fact “client SYN on external VLAN, no server-side SYN in tcpdump.” Quick answer (from the PDF) Find the last known-good point. Stop at the first layer where packet evidence breaks. On a Standard VS, client TCP and server TCP are two conversations. ## Build the problem statement first Slide 4 of the PDF: a precise intake cuts troubleshooting time in half. Without it you chase the wrong VIP, port, or timeframe. Module 7 PDF · slide 4 · intake Lab values from the PDF: source 198.51.100.50, www.example.com, VIP 192.0.2.100, 443/TCP HTTPS, expected login page, actual timeout. Do not assume Do not open tmsh or the GUI until source, VIP, port, timestamp+timezone, expected vs actual, and last change are written down. ## Master flow + decision-tree infographic PDF slide 5: work top-down. Stop at the first layer that has no packet proof. Slide 16 is the full decision-tree infographic from the same module. Module 7 PDF · slide 5 · master flow PDF question at every stage: “Do I have packet evidence that this layer is working?” Infographic from your PDF · slide 16 Do not ask “what setting should I change?” Ask “where does the traffic stop?” Toolbox on the right is the PDF command set. Say this out loud The packet path is the troubleshooting map. I will not change config until I know the last hop that still worked. ## DNS, client SYN, Virtual Server (PDF slides 6–9) Module 7 PDF · slide 6 · DNS PDF: if DNS returns 192.0.2.200 but the VIP is 192.0.2.100, BIG-IP work is irrelevant until DNS is fixed. From Module 7 PDF dig www.example.com nslookup www.example.com host www.example.com # expected A: 192.0.2.100 Then prove the client SYN actually hits BIG-IP. If SYNs never arrive, the fault is upstream (route, firewall, ACL, NAT) — not the pool. PDF client capture tcpdump -nni 0.0 host 198.51.100.50 Local Traffic › Virtual Servers › vs_web_https Training mock · not live Matches PDF VS checks: dest IP, port, protocol, VLAN, enabled ### vs_web_https Destination 192.0.2.100 Service Port 443 Type Standard Default Pool WEB_POOL PDF: more-specific destination prefix wins at a high level. Client to 192.0.2.100:443 does not match a VS on :8443. PDF VS commands tmsh show ltm virtual tmsh list ltm virtual vs_web_https ## Pool, monitor, route, ARP, SNAT (PDF slides 10–17) Module 7 PDF · slide 10 · pool PDF: inspect members, not only the pool icon. Web01/Web03 UP, Web02 DOWN. Check disabled vs forced offline vs monitor-down. From the PDF tmsh show ltm pool tmsh show ltm pool WEB_POOL tmsh list ltm pool WEB_POOL tmsh show ltm node 10.20.20.101 PDF health-monitor trap: a trailing space on the receive string can fail the monitor silently. Reproduce the monitor, including Host header for name-based apps. PDF monitor reproduce curl -v http://10.20.20.101/health curl -v -H "Host: www.example.com" http://10.20.20.101/health curl -vk https://10.20.20.101/health Module 7 PDF · slide 15 · ARP PDF: route table can look correct while ARP is Incomplete for 10.20.20.101 — the packet still cannot reach the backend. PDF ARP / route tmsh show net route tmsh list net route tmsh show net arp ip neigh arp -an PDF SNAT lesson: asymmetric routing is one of the most common silent failures. Client → BIG-IP → server, server replies via a router that bypasses BIG-IP. Do not enable Automap blindly. Module 7 PDF · slide 17 · SNAT / return path Either fix the return route so replies hit BIG-IP, or SNAT so the server sees a BIG-IP source. ## Infographic: tcpdump client-side vs server-side Infographic from your PDF · slide 11 Capture A = client 198.51.100.50. Capture B = server 10.20.20.101. A: no client SYN (upstream). B: client SYN, no server SYN (BIG-IP decision). C: server SYN, no SYN-ACK (backend/network). D: server answers, client never gets it (return/client-side). PDF targeted captures tcpdump -nni 0.0 host 198.51.100.50 tcpdump -nni 0.0 host 10.20.20.101 tcpdump -nni 0.0 'host 198.51.100.50 or host 10.20.20.101' tcpdump -nni 0.0 -s0 -w /var/tmp/app_issue.pcap PDF security warning PCAPs may contain sensitive application data. Capture narrowly, protect the file, delete/archive to policy. F5 K6546: interface 0.0 is not rate-limited like hardware switch taps — filter it in production. Module 7 PDF · slide 18 · connection table PDF: after SNAT the backend sees 10.20.20.10, not 198.51.100.50. Filter syntax varies by version. PDF tmsh show sys connection Module 7 PDF · slide 19 · full proxy Two TCP sequence spaces. Handshake 1 can succeed while handshake 2 SYN-retransmits — the browser still times out. ## Infographic: SYN, RST, retransmissions Infographic from your PDF · slide 3 PDF memory strip: SYN only = no reply from destination path. RST = someone rejected. Retransmits = expected ACK missing. 3-way complete = TCP worked, app can still fail. Module 7 PDF · slide 22 · who sent the RST PDF: never say “F5 reset the connection” without the RST source IP and capture location. RST from 10.20.20.101 right after SYN usually means no listener on that port. Root cause discipline Retransmissions are a symptom, not a root cause (PDF slide 21). Check loss, congestion, silent firewall drop, busy server, asymmetric routing, MTU — do not auto-blame TMM. ## Infographic: VIP is green, application is down Your 22-slide PDF stops at RST analysis. This poster is the production RCA that uses the same IPs and the same last-known-good method. Techclick infographic · VIP green ≠ app healthy Symptom timeout. Evidence: client SYN reached BIG-IP, BIG-IP sent SYN, no SYN-ACK. Cause: backend firewall. Fix: allow 10.20.20.0/24 to :443. Then re-validate TCP + TLS + HTTP. PDF / poster hop If this fails First command DNS Wrong VIP dig www.example.com Client SYN Upstream tcpdump -nni 0.0 host 198.51.100.50 VS match Port/VLAN/proto tmsh list ltm virtual Pool / member Monitor, disabled, port tmsh show ltm pool WEB_POOL Server SYN / SYN-ACK Backend/FW/ARP tcpdump -nni 0.0 host 10.20.20.101 Return to client SNAT / client TLS / iRule tmsh show sys connection ## Traps from the Module 7 PDF PDF trap What it looks like Proof Change config first SNAT/iRule flapping Written intake + last known-good packet Green pool = healthy app VS/pool Available, users timeout Client SYN and server SYN in tcpdump Monitor receive string space Member DOWN, curl works Reproduce exact send/receive including Host Route without ARP Route exists, Incomplete ARP tmsh show net arp Asymmetric return Server capture OK, BIG-IP never sees reply Server default gateway vs SNAT RST means F5 Someone said “F5 reset” RST source IP + capture point (slide 22) Wide 0.0 capture Huge PCAP Host+port filter; K6546 Lab task (same PDF topology) 1) Point DNS to 192.0.2.200 and prove LTM is the wrong box. 2) VS port 443 vs 8443 mismatch. 3) Firewall drop on member :443 — SYN without SYN-ACK (infographic scenario C). 4) Strip Host from the HTTP monitor. 5) Save a filtered PCAP, then delete it. Interview question (PDF) “VIP is green, site times out. First packet question?” Did the client SYN reach BIG-IP, and did BIG-IP send a server-side SYN? Weak: “I would bounce TMM.” ## Knowledge check Judgment from your Module 7 PDF + the VIP-green poster. Q1 PDF mindset: ticket says “F5 is dropping traffic.” First move? Enable SNAT Automap Turn it into a fact: last SYN location, VIP, port, time Sync from standby Delete the iRule Correct: b . PDF slide 2: convert every assumption into an observable fact before changing config. Q2 PDF DNS slide: dig returns 192.0.2.200, application VIP is 192.0.2.100. Next? tcpdump on BIG-IP anyway Force pool member up Stop LTM work until DNS returns the real VIP Failover the traffic group Correct: c . PDF: if DNS is wrong, BIG-IP troubleshooting is irrelevant until DNS is corrected. Q3 tcpdump infographic scenario B: client SYN on BIG-IP, no server-side SYN. Where is the fault domain? BIG-IP decision path (VS, pool, iRule, policy, route, limits) Definitely the backend firewall Client PC is down Always persistence Correct: a . Infographic scenario B: BIG-IP never opened the server-side flow. Q4 PDF ARP slide: route exists, ARP Incomplete for 10.20.20.101. What is true? Packets still reach the backend because the route is present The packet cannot reach the backend until ARP resolves TMM is crashed SNAT Automap will fix ARP Correct: b . PDF: route + ARP must both succeed. Q5 TCP infographic: 3-way handshake completes, then RST. What did TCP prove? The application is healthy TCP established; failure is later (TLS, app, timeout, policy) F5 software is broken DNS is wrong Correct: b . Memory strip: 3-way complete means TCP works; the application can still fail later. Q6 VIP-green poster: client SYN reached BIG-IP, BIG-IP sent SYN, no SYN-ACK. Best RCA? Backend/network path after BIG-IP (often firewall) — not the green VIP The Virtual Server is down Client never sent a SYN Always a ConfigSync split Correct: a . Green VIP is one hop. Last SYN observed leaving BIG-IP with no SYN-ACK points at the server path. Check answers Reset ## Sources - F5-BIG-IP-LTM-Module-7.pdf — your 22-slide Techclick module in Downloads (primary). Infographics: slides 3, 11, 16. - K6546 — tcpdump on 0.0 is not rate-limited like switch taps; filter in production - K00463541 — tcpdump -nn , interface 0.0, version-specific F5 trailers - K40033505 — tmsh show sys connection is data-plane - K14800 — virtual server match uses dest/src/port Related: SSL offload vs re-encrypt · SNAT · Evidence desk · F5 interview · Syllabus Command flags can vary by BIG-IP version. Confirm on the running release. PDF training mocks are not live TMUI. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt