Radware fault capture logic

Document introduction: this paper introduces the method of further grasping packet location and grabbing the message on the whole line when there is an access failure in radware.

I. Topology

2. Flow analysis

The virtual address 10.2.2.10 of the server is accessed from the client, and the load balancer uses the pip address instead of the client to access the actual physical address 10.2.2.1. The server returns the data message to the pip address, and the load balancer sends it to the client with the VIP address.

The client makes a three-way handshake with the load balancer, and the load balancer establishes a three-way handshake with the client and the server with vip and pip, respectively.

III. Specific orders

To grab packets on the entire link, you need to grab packets in three places:

1. Client, filter address is vip address

Tcpdump-I eht0 host 10.2.2.10

2. Radware. Filter address is pip address and client address.

/ maint/pktcap/capture host 10.2.2.10 or 10.1.1.1

3. Server. Filter address is pip address.

Tcpdump-I eht0 host 10.2.2.100