Forum Discussion

Amit585731's avatar
Amit585731
Icon for Nimbostratus rankNimbostratus
Oct 29, 2015

Regarding SYN flood attack

Hi ALL,   We are seeing SYN Cookie threshold exceeding on LTM while I think we are not seeing this huge connection from source so it can cross threshold limit of 16,384...   Internal warning tm...
application delivery
deployment
LTM
Brad_Parker_139's avatar
Brad_Parker_139
Icon for Nacreous rankNacreous
Oct 29, 2015

I don't think there is a SOL for it in the wild, but you need to turn off hardware SYN cookie protection for network virtual servers. It doesn't behave properly when turned on for anything other than a /32 destination virtual server. We had many problems with this last year and our local FSE finally confirmed it and sent out a newsletter detailing that it should be turned off. Software SYN cookie protection should get you by for those network VIPs. If not, contact your local F5 team. As soon as you disable hadrware SYN cookie in the TCP/FastL4 profile attached to the VS you should see things get better.

 

  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Oct 29, 2015
    PS this is only an issue on platforms that can do hardware SYN cookie in their PVA cards. 5000s+ and Viprion.
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Oct 29, 2015
    What usually triggers this erroneous behavior are packet drops up stream.
  • Amit585731's avatar
    Amit585731
    Icon for Nimbostratus rankNimbostratus
    Oct 30, 2015
    Thanks Brad. Yes becoz we continued to see issue continually we have already disabled SYN Cookie and enabled Software Cookie globally.
  • Amit585731's avatar
    Amit585731
    Icon for Nimbostratus rankNimbostratus
    Oct 30, 2015
    Also by any chance you know what that value 186 is in 'show sys connection' output I mentioned? is the number of connection from source to VS?
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Oct 30, 2015
    show sys connection shows all the connections to the LTM. The TCP 186 you see I believe is the age of that connection in seconds.
  • Amit585731's avatar
    Amit585731
    Icon for Nimbostratus rankNimbostratus
    Oct 31, 2015
    thanks Brad for all your help.