We have 3 node web cluster published over http/s with super http persistence . as you can see it is not very "balanced" ! We believe tthis is due to the higher connection rate to the 192.168.249.35 node ( more than twice the other nodes ) . If we disable this node temporarily and then reenable it, the pattern will shift to another node. my question : How can i see where the individual connections are originally coming from. looked at netstat / l7adm trace logs but this does not seem to show this level of information.