F5 Platform Architecture, Traffic Processing, and Troubleshooting
Domain scope
The F5 platform architecture, traffic processing, and troubleshooting domain tests how BIG-IP separates management from packet forwarding and how to prove where a connection is lost. Expect TMOS component questions, full-proxy versus FastL4 behavior, and command-level troubleshooting.
Control plane and data plane
TMOS runs on a Linux host. The control plane handles the GUI, tmsh, iControl REST, configuration, logging, and monitor scheduling. TMM is the data plane: it runs in user space on dedicated cores, receives packets from the network interfaces, and performs virtual-server matching, profiles, persistence, iRules, and pool selection. In full-proxy mode the client-side and server-side TCP connections are independent, so BIG-IP can acknowledge a client before the server responds. FastL4 and Performance L4 reduce that separation for throughput.
Packet path
A packet arrives on a VLAN, matches a virtual server destination and port, passes the attached profiles, then iRules, then pool selection and SNAT, then a pool member. The return path must be routable: if SNAT is not used, the server must route back to BIG-IP, not directly to the client.
Troubleshooting toolkit
Use tmsh show ltm virtual <vs> detail for destination, pool, profiles, and VLAN settings; tmsh show sys connection for connection state; tmsh show sys tmm-traffic and tmsh show sys performance for throughput and drops. Capture data-plane traffic with tcpdump -i 0.0 -nn -s0 -w /var/tmp/cap.pcap (0.0 is all interfaces); use ssldump for TLS handshakes. Logs are in /var/log/ltm and /var/log/audit. qkview and iHealth collect support data. Restarting TMM with tmsh restart sys service tmm clears data-plane state but does not load unsaved configuration.
Worked example
A client times out to 10.20.30.40:443. The virtual server reports available and the pool member is up. A capture on the client VLAN shows repeated SYNs and no SYN-ACK; a capture on the server VLAN shows no SYN to the member. Since the packet reaches BIG-IP but is not forwarded, the problem is in virtual-server matching or VLAN attachment, not the pool. tmsh show ltm virtual vs-https detail shows the client VLAN is not enabled on the virtual server. Enabling that VLAN restores service. If the server-side capture had shown a SYN but no response, the next check would be server routing and SNAT.
Traps
Available is monitor state, not proof that traffic works. Capturing on the management interface misses TMM traffic. A wildcard virtual server can match before the intended one. Unsaved tmsh changes disappear after a restart.