First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

How to find time gap for a session

Hi,

I am doing a troubleshooting. I see when traffic is over f5 session get disconnected after 5 mins but not when it is dirrect ?

How can I proof from F5 capture that traffic is disconnecting after 5 mins from wireshark

Subrun's avatar
1
Subrun
asked 2023-07-17 20:47:41 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

The default idle timeout in a TCP profile on F5 is 300 seconds. So it sounds perfectly logical. You can detect a 300 sec gap in all TCP session with the filter tcp.time_delta > 300 (either as a filter or by using the find function). The F5 may or may not close the session with a TCP RST. If it does, you can check the IP TTL and compare it with other packets from the source behind the F5.

SYN-bit's avatar
18.5k
SYN-bit
answered 2023-07-18 21:32:13 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer