Bug ID 1492681: Running tcpdump on a busy system may cause traffic drop.

Last Modified: Jul 11, 2024

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1

Fixed In:
17.1.1.2

Opened: Jan 19, 2024

Severity: 1-Blocking

Symptoms

Traffic throughput can be degraded.

Impact

Moderate to severe throughput drop is observed.

Conditions

The tcpdump application is executed on high throughput systems.

Workaround

As a general recommendation, use tcpdump filters described in K411 or K2289 while capturing the packets on moderately busy systems. However, on very busy systems, filters alone may not be enough. In this case, there is No workaround.

Fix Information

Added a new db key 'tmm.tcpdump.pkt.ratelimit'. The default value of this db key is '0'. Also, this is the same behavior with the previous fix. When the value is set to the default value (0), the TMM doesn’t do any rate limiting on the traffic that is sent to the tcpdump application. When the value is set to any other value x, then the TMM applies rate limit of the value x and sends x packets/sec on an average to tcpdump application during capture cycle. For example, if the db variable is set to 200, then each TMM sends an average of 200 pkts/sec to tcpdump application during the life cycle of tcpdump application.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips