F5 is a company specializing in networking and security products. F5's load balancer is finding its way into many organizations. This report leverages returned information found in the HTTP protocol allowing us to detect the existence of F5 products, and thus report on the market penetration rate of these products.

The detection of F5 is done via two basic mechanisms:

1. The server signature may return back an indicator of "BigIP".

$ telnet 192.168.1.1 80
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.0 301 Moved Permanently
Location: https://192.168.1.1/
Server: BigIP
Connection: close
Content-Length: 0

Connection closed by foreign host.
$

2. The cookies returned back may indicate a load balancer is in use.

$ telnet 192.168.1.1 80
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.0 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: http://www.myserver.com
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 20 Jun 2015 19:28:31 GMT
Connection: close
Content-Length: 151
Set-Cookie: BIGipServerWebCluster_4=1137223872.20480.0000; path=/

Connection closed by foreign host.
$

The following graph and table demonstrates the percentage of IP addresses that are indicating one of the above mentioned signatures. The sample size (the # of distinct IP addresses hosting a web server of some sort) is: 1,939,545.

Date	BigIP Count	IP Address Sample Size	% Share	% Growth
Aug 2002	678	1,939,545	0.03	6.62
Jul 2002	640	1,952,002	0.03	N/A

This report was added to our monthly roster of reports on July 1st, 2015, with backdated reports dating back to July 2002 added on June 23rd, 2015.