Gets or sets the value of the specified option kind from the TCP header.
The TCP::option get command is only functional when BIG-IP has been configured to collect options before the iRule is called. In v10, this is done with a db variable and is effective only on the clientside. When called in the serverside context it returns an error indicating that the specified option was not configured for collection.
In v11, this is configured through the TCP profile and the command can be used in either the serverside context or the clientside, depending on the profile configuration. TCP::option set is available only in v11 and can be used in either context.


TCP::option get <option>

v11 Additions/Changes:
TCP::option set <option number> <value> <next|all>
TCP::option noset <option number>

TCP::option get <option>

  • Returns the specified TCP option kind value. If the requested option kind was not configured for collection, an error indicating so is returned instead. If the option kind was specified but has not yet been seen on the current connection, the command returns null. If the requested option kind has been configured for collection and has been seen on the connection, the command returns the raw option kind value. See version-specific sections below regarding configuring option kinds for collection.

TCP::option set

  • Allows you to set (or add) TCP option information for the specified option field

TCP::option noset

  • Allows you to specify particular TCP options that should not be set.

Configuring for TCP option collection - BIG-IP version >= 10.2.0-HF2 and < 11.0.0

The Rules.tcpoption.settings database variable must be configured in order to use the TCP::option command in 10.2.0HF2 < 11.0, specifying the option values to be collected. In TMOS versions 10.2.0 HF2 through 10.2.2, the BIG-IP system must be restarted using the bigstart restart command after setting or modifying the variable. Starting with release 10.2.2 HF1 the restart is no longer required.
Configure the db variable Rules.Tcpoption.settings with a string in the following format:

Note: Do not change the unrelated db setting Rules.tcpoption.virtuals from its default value of null in 10.2.0-hf2. This will cause tmm to repeatedly restart.

Configuring for TCP option collection - BIG-IP version 11.0.0 and up

Beginning with v11.0.0 the ‘db variable Rules.TCPoption.settings’ no longer exists and this functionality has been ‘baked in’. It is now part of the tcp profile and is configured as follows”

create ltm profile tcp PROFILE_NAME tcp-options “{option <first|last>} {option <first|last>}”


  • A number between 2 and 255 (inclusive) that indicates the TCP option kind to be collected.

first | last

  • Indicates whether the system will retain the first instance of the specified option kind, or the most recent.

When an option kind is marked first, the system will search for the specified option kind only until it has been seen on the current connection. Once seen, the TCP::option command will return that value for the life of the connection.
When an option kind is marked last, the system will continue to search for the specified option kind over the lifetime of the connection. The TCP::option command will return the last value seen at the time it is called.
If all option kinds are marked first, and all specified option kinds have been seen on that TCP connection, no further searching will be performed for the life of the connection.
For example, the following command configures the BIG-IP system to save the value of the first instance of option kind 8, and the value of the last seen instance of option kind 28:
v10: b db Rules.Tcpoption.settings [8,first],[28,last]
v11: create ltm profile tcp profile_name tcp-options “{8 first} {28 last}”


  set INPUT_OPTION [TCP::option get 28]
  binary scan $INPUT_OPTION c ver
  set ver [expr { $ver & 0xff }]
  set forwarded_ip [IP::addr parse $INPUT_OPTION 1]
  log local0. "The IP address was $forwarded_ip for version $ver"

This example is further explained in the Accessing TCP Options from iRules article.
scan [IP::client_addr] {%d.%d.%d.%d} a b c d
TCP::option set 28 [binary format cccc $a $b $c $d] all

This example is showing in the server connection, how to insert the client REAL IP (mostly used when the client IP is SNATted).