F5 BIG-IP load balancer persistence cookies

BIGipServerexample.com_80_pool=<encoded_ip>.<encoded_port>.<flags>

• <encoded_ip>: encoded backend IP address (IP address in little-endian format)

• <encoded_port>: encoded backend port (<port_number> * 256)

• <flags>:flags (usually unused)

Decode example

175667978.20480.000

IP Address

• Convert to hex:

  175667978 = 0x0A78B50A

• Split into bytes (little-endian → reverse):

  0A 78 B5 0A   → reverse →   0A B5 78 0A

• Convert to decimal:

  0A = 10
  B5 = 181
  78 = 120
  0A = 10

• Backend IP = 10.181.120.10

Port

• Decode the port

20480 ÷ 256 = 80

Decode BigIP cookie

• Write th following script BigIP_cookie_decoder.py:

  import socket
  import struct
  import re
  from tabulate import tabulate
  import sys
  from termcolor import cprint, colored
  
  def decode_bigip_cookie(cookie: str) -> dict:
      """
      Decode F5 BIG-IP persistence cookies.
  
      Supports:
      - IPv4 BIGipServer cookies
      - Route domains (rdX)
      - Named or unnamed cookies
  
      Returns a dict with decoded values or error info.
      """
  
      result = {
          "Backend IP": None,
          "Backend Port": None,
          "Route Domain": None,
      }
  
      try:
          # Extract cookie value (after '=' if present)
          value = cookie.split("=", 1)[-1]
  
          # Extract route domain if present (rdX)
          rd_match = re.search(r"rd(\d+)", value)
          if rd_match:
              result["Route Domain"] = int(rd_match.group(1))
              value = value.replace(rd_match.group(0), "")
  
          # Split numeric parts
          parts = value.strip(".").split(".")
          if len(parts) < 2:
              raise ValueError("Invalid BIG-IP cookie format")
  
          ip_part = int(parts[0])
          port_part = int(parts[1])
  
          # Decode IP (little-endian)
          ip_hex = struct.pack("<I", ip_part)
          backend_ip = socket.inet_ntoa(ip_hex)
  
          # Decode port
          backend_port = port_part // 256
  
          result["Backend IP"] = colored(backend_ip, "red")
          result["Backend Port"] = colored(backend_port, "green")
  
          print("\nCookie: "+colored(cookie, "yellow"), end="\n\n")
          print(tabulate([list(result.values()),], headers=[colored(h, "blue") for h in list(result.keys())], tablefmt="fancy_grid"), end="\n\n")
  
      except Exception as e:
          print("ERROR:"+str(e))
  
      return result
  
  
  if __name__ == "__main__":
      decode_bigip_cookie(sys.argv[1])

• Run the script

  python3 BigIP_cookie_decoder.py <BigIP_cookie>