Bug ID 468300: Filters may not work correctly with websockets or CONNECT

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
11.2.1, 11.4.0, 11.4.1

Fixed In:
11.6.0, 11.5.4 HF3

Opened: Jun 20, 2014

Severity: 3-Major

Related Article: K16690


If filters that buffer messages exist on the chain, then when HTTP switches to pass-through mode, those filters may spuriously fail to see the headers of the response that cased that switch. The problem is due to HTTP immediately switching into pass-through mode, and then sending the headers as raw data through the chain.


The TMM may core, or wrong information may be obtained from filters looking at the HTTP headers of a response that causes a switch to pass-through mode.


A filter on the chain that buffers a RESPONSE_DONE message, and HTTP switches to pass-through, combined with looking at the headers in a filter other than HTTP. This is more likely to happen if the server sends data immediately after a successful CONNECT or transition to websockets. (Without waiting for a response from the client.)


This issue has no workaround at this time.

Fix Information

HTTP now waits until all filters have seen a 101 Switching Protocols or CONNECT 200 Connected response before switching into pass-through mode.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips