Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Testing a application in the PROD environment for the first time, we found that while the xhr-polling transport (Ajax long polling) works, the websocket transport does not.

Looking at the data transmitted using Fiddler, I can see that the

  • UPGRADE happens and
  • the first message from the server (5 bytes gross) arrive at the client.
  • The client then sends a couple of messages to the server, which normally result in server->client messages

But those server->client messages never arrive (I'm not even sure if the client->server messages arrive on the server side). Eventually (after about 6 seconds), Fiddler reports a

Read from Server failed...

and a new connection gets established, as unsuccessful as the first one.

Our setup looks something like this:

Internet -> Firewall -> BIG-IP 3600 (terminates SSL) -> Node.js server

I'd think the firewall could not be the culprit, as all it sees is an SSL encrypted stream of data, and with a the non-websocket transport it does works. I also tried the match origin protocol option in, without success.

Unfortunately I cannot freely play in that environment, so I tried to replicate the issue in my DEV environment, without success. I created a software SSL proxy (using node.js's http-proxy), which should work similar to BIG-IP. But going through that SSL proxy with websockets works just fine.

Could this a be an issue with the BIG-IP? Configuration? What else could it be?

share|improve this question
As of December of 2012, BIG-IP doesn't support SSL offload of WebSocket traffic. How are you managing to do this? – David Schwartz Jan 28 '13 at 7:58
Do you have any link where this issue is addressed? And maybe an explanation on why SSL offloading WebSockets would be an issue? – Eugene Beresovsky Jan 28 '13 at 8:05
It's a direct quote when asked if it was supported. They said it was not and to submit a feature request through their support channel. The issue is that it thinks it's HTTP and doesn't recognize when the direction of flow changes. – David Schwartz Jan 28 '13 at 8:07
Interesting. Wouldn't that also affect other transports like chunked http transfer, as used by's htmlfile, to do streaming (works only downstream: server -> client) – Eugene Beresovsky Jan 28 '13 at 8:12
I assume it understands chunked transfer. – David Schwartz Jan 28 '13 at 8:12
up vote 1 down vote accepted

As of December of 2012, BIG-IP doesn't support SSL offload of WebSocket traffic. Because the requests look like HTTP, they're processed by an HTTP engine that doesn't understand when the direction of flow changes for a WebSocket connection. Don't use SSL offload with WebSocket connections until it's officially supported.

share|improve this answer
Couldn't something like configuring ELB on TCP/SSL, instead of HTTP/HTTPS, makes the trick with WebSockets be done with BIG-IPs? – Eugene Beresovsky Jan 29 '13 at 5:48
I would think so. – David Schwartz Jan 29 '13 at 15:25
Any update on this? Thanks. – NullOrEmpty Jan 23 '14 at 11:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.