odd behaviour in loadbalancing


We have 3 node web cluster published over http/s with super http persistence . as you can see it is not very "balanced" ! We believe tthis is due to the higher connection rate to the node ( more than twice the other nodes ) . If we disable this node temporarily and then reenable it, the pattern will shift to another node.  my question : How can i see where the individual connections are originally coming from.  looked at netstat / l7adm trace logs but this does not seem to show this level of information. 

1 comment


Do you mean the source IP addresses of the clients? The easiest way is probably to check this on the firewall in front of the loadbalancer or get some netflow stats from your switches/routers.

Do clients connect directly to your VS? Or is there a source NAT translation happening somewhere in the network path to the loadbalancer or maybe some sort of proxying service in front of the loadbalancer?