F5 is a company specializing in networking and security products. F5's load balancer is finding its way into many organizations. This report leverages returned information found in the HTTP protocol allowing us to detect the existence of F5 products, and thus report on the market penetration rate of these products.

The detection of F5 is done via two basic mechanisms:

1. The server signature may return back an indicator of "BigIP".

$ telnet 192.168.1.1 80
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.0 301 Moved Permanently
Location: https://192.168.1.1/
Server: BigIP
Connection: close
Content-Length: 0

Connection closed by foreign host.
$

2. The cookies returned back may indicate a load balancer is in use.

$ telnet 192.168.1.1 80
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.0 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: http://www.myserver.com
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 20 Jun 2015 19:28:31 GMT
Connection: close
Content-Length: 151
Set-Cookie: BIGipServerWebCluster_4=1137223872.20480.0000; path=/

Connection closed by foreign host.
$

The following graph and table demonstrates the percentage of IP addresses that are indicating one of the above mentioned signatures. The sample size (the # of distinct IP addresses hosting a web server of some sort) is: 2,509,200.

Date	BigIP Count	IP Address Sample Size	% Share	% Growth
Nov 2004	1,618	2,509,200	0.06	1.99
Oct 2004	1,568	2,480,006	0.06	0.83
Sep 2004	1,535	2,448,080	0.06	1.69
Aug 2004	1,498	2,429,493	0.06	0.61
Jul 2004	1,483	2,419,814	0.06	2.27
Jun 2004	1,403	2,341,254	0.06	2.06
May 2004	1,404	2,391,293	0.06	-0.10
Apr 2004	1,395	2,373,501	0.06	1.72
Mar 2004	1,363	2,358,868	0.06	2.56
Feb 2004	1,328	2,357,211	0.06	-2.43
Jan 2004	1,352	2,341,463	0.06	2.68
Dec 2003	1,311	2,331,238	0.06	4.52
Nov 2003	1,244	2,312,009	0.05	8.74
Oct 2003	1,145	2,313,990	0.05	2.33
Sep 2003	1,103	2,280,977	0.05	2.29
Aug 2003	1,058	2,237,957	0.05	1.49
Jul 2003	1,042	2,236,929	0.05	2.42
Jun 2003	999	2,196,536	0.05	5.31
May 2003	950	2,199,629	0.04	5.01
Apr 2003	888	2,159,180	0.04	2.79
Mar 2003	855	2,136,967	0.04	0.45
Feb 2003	828	2,078,823	0.04	-1.83
Jan 2003	825	2,033,445	0.04	2.67
Dec 2002	764	1,933,463	0.04	1.93
Nov 2002	766	1,976,033	0.04	4.10
Oct 2002	738	1,981,841	0.04	2.29
Sep 2002	709	1,947,616	0.04	4.14
Aug 2002	678	1,939,545	0.03	6.62
Jul 2002	640	1,952,002	0.03	N/A

This report was added to our monthly roster of reports on July 1st, 2015, with backdated reports dating back to July 2002 added on June 23rd, 2015.