BIGip implements load balancing through Virtual servers, iRules, Pool, Node, Monitor, and Persistent (session persistence). When a user initiates a request for the first time, BIGip will set a cookie for the user. That is, the server will add a set-cookie response header (for example: set-cookie: BIGipServerFinanceAndAdminWebfo.unc.edu = 110536896.20480.0000). Subsequent requests determine and use this cookie value, and the server decodes the cookie and uses the server.

Go to the decryption tool

MAC @ MAC F5 - BIG - IP - Cookie - Decoder - master % python f5decoder. The py 110536896.20480.0000 [*] success | 110536896.20480.0000 | 192.168.150.6:80Copy the code

F5decoder. Py content

# -*- coding: utf-8 -*-
import struct
import sys
class Colors:
    BLUE 		= '\033[94m'
    GREEN 		= '\033[32m'
    RED 		= '\033[0;31m'
    DEFAULT		= '\033[0m'
    ORANGE 		= '\033[33m'
    WHITE 		= '\033[97m'
    BOLD 		= '\033[1m'
    BR_COLOUR 	= '\033[1;37;40m'
if len(sys.argv) ! =2:
    print("[*] python f5decoder. Py 185903296.21520.0000" % sys.argv[0])
    exit(1)
encoded_string = sys.argv[1]
(host, port, end) = encoded_string.split('. ')
(a, b, c, d) = [ord(i) for i in struct.pack("<I".int(host))]
decIp = "%s.%s.%s.%s"%(a,b,c,d)
(e) = [ord(e) for e in struct.pack("<H".int(port))]
decPort = str(int("0x%02X%02X" % (e[0],e[1]),16))
result = Colors.GREEN + "[*] success \t " + Colors.WHITE+"|" + Colors.DEFAULT + encoded_string +Colors.WHITE+ " \t | "+ Colors.BLUE + decIp +Colors.BLUE+ ":" + Colors.BLUE + decPort + Colors.DEFAULT
print(result)
Copy the code

Related information:

The Facebook server Intranet IP is obtained from the session Cookie of F5 big-IP LTM

Personal official account (big data learning communication): Hadoopwiki