BIG-IP tcpdump builder

Assemble a BIG-IP-correct tcpdump command from structured choices: the TMM interface syntax, flow detail, snaplen, file output, and a BPF filter. It formats the command for you to run; it captures nothing.

Documentation (Markdown)

Networking

Interface and flow

Interface or VLAN

0.0 captures on every TMM. You can also name a VLAN, a tunnel, or a self-IP.

TMM flow detail

Adds the F5 noise/flow trailer to each packet. Higher detail prints flow and peer-flow information.

Both sides (:p)

Capture the client-side and server-side flows of the same connection.

Name resolution

DNS and port-name lookups

-n and -nn keep the capture fast and avoid reverse lookups that can stall it.

Snap length and limits

Snap length

Stop after N packets (-c)

Optional. Leave blank to capture until you stop it with Ctrl-C.

Output format

Verbosity

Link-level header (-e)

Hex and ASCII payload (-X)

Write to file

Write a pcap file (-w)

File path

Required when sending a capture to F5 Support. Save under /var/tmp or /shared/tmp.

Filter

BPF filter expression

Standard tcpdump/BPF syntax: host, net, port, src/dst, tcp/udp, and / or / not.

The command is assembled in your browser. Nothing is captured, run, or sent anywhere.

Command

tcpdump -nn -i 0.0:nnnp -s0 -w /var/tmp/capture.pcap host 10.1.1.1

Advisories

On BIG-IP 15.x and later, -s0 maps to the default snap length of 262144 bytes (kept for compatibility), so it still captures whole packets.

API endpointGEThttps://ronutz.com/api/v1/f5-bigip-tcpdump-builderDocumented, not served. Opens the specification.