Hello Javier,
On Tue, Oct 27, 2015 at 11:18:13AM -0400, Javier Torres wrote:
> Hello,
>
>
>
> I???m currently working toward troubleshooting an application that is using
> HA Proxy for load balancing and would like to leverage this great tool to
> help correct the problem. We would like to know how we can turn on packet
> capture tool?
Please note that haproxy doesn't see *packets*, it sees *byte streams* the
OS brings up. There's no direct relation between packets and the data haproxy
sees. The typical issues with incorrect checksums, too large packets that
were improperly aggregated by an hypervisor, out-of-ordered packets, and so
on will not show up in haproxy and may lead you to false deduction (eg: "I
don't receive your packets" so they're lost somewhere else). It's important
to use a packet capture tool to capture packets.
If you want to know what's inside the stream (typically does the client send
a header, cookie or so), then the stream analysis is more suited. A long time
ago I wanted to implement a debug mode on the CLI which would dump buffer
contents before they are forwarded, but I realized it was more complicated
than it seems because we need to pause every session waiting for some room
in the capture buffer. However there's a trick when you want to see the
clear text inside encrypted traffic : simply chain two instances together
on 127.0.0.1 and run tcpdump on the loopback :
listen ssl-to-clear
bind 1.1.1.1:443 ssl crt blah.pem
server next 127.0.0.1:4343 send-proxy-v2
listen clear-to-ssl
bind 127.0.0.1:4343 accept-proxy
server next 2.2.2.2:443 ssl verify none
and run : tcpdump -s0 -ni lo port 4343 -w clear.cap. The proxy protocol
will tell you the client's address at the beginning of each connection.
You can also do this in transparent mode using a bit of tproxy :
listen ssl-to-clear
bind :443 transparent ssl crt blah.pem
server next 127.0.0.1:4343 send-proxy-v2
listen clear-to-ssl
bind 127.0.0.1:4343 accept-proxy
server next 0.0.0.0 source 0.0.0.0 usesrc clientip ssl verify none
Hoping this helps,
Willy
